Claude Code Security Review is an official open-source GitHub Action from Anthropic that uses Claude to review code changes for security vulnerabilities. The repository has about 6,500 stars on GitHub and was updated in 2026.
The Action runs automatically on pull requests and performs diff-aware, semantic analysis of the changes rather than simple pattern matching, so it can reason about how new code interacts with its surroundings. Findings are posted back as pull request comments for reviewers, with built-in false-positive filtering to keep the signal high. It works across programming languages, and scan instructions can be customized to focus on the vulnerability classes your team cares about. The same capability is also available interactively as the /security-review slash command inside Claude Code. Anthropic notes that the Action itself is not hardened against prompt injection, so teams should treat it as one layer of review rather than a guarantee. Setup takes only minutes: add the workflow to a repository, provide Claude API access, and security reviews begin automatically on the next pull request.
The Action is free and open source under the MIT license. You run it with your own Claude API access, and the underlying API usage is billed by Anthropic as usual.
Engineering teams on GitHub who want an AI security pass on every pull request, especially teams already using Claude Code day to day.