DEV Community

七品
七品

Posted on

Automated Security Audits for Your Codebase Using Claude Code

#security #python #webdev #devops

Automated Security Audits for Your Codebase Using Claude Code

Let's be honest: most of us aren't security experts. But we're shipping code to production, handling user data, and integrating with third-party APIs. One SQL injection, one exposed API key, one JWT misconfiguration — and you're dealing with a security incident.

I built a Claude Code skill that acts as a security-focused code reviewer. Here's how it works and how you can use it to catch vulnerabilities before they reach production.

The Problem: Security Is an Afterthought

In my experience, security reviews usually happen:

  1. After a breach — the worst time
  2. Before a major audit — rushed and stressful
  3. Never — most common for indie devs and small teams

The typical excuses:

  • "I don't know what to look for"
  • "A proper security audit costs thousands"
  • "I'll fix it in the next sprint" (famous last words)

The Solution: Automated Pattern-Based Auditing

The key insight is that most security vulnerabilities follow recognizable patterns. SQL injection has a pattern. Insecure deserialization has a pattern. JWT alg:none attacks have a pattern.

Once you know the patterns, you can automate the detection.

I created a Code Security Guardian skill that encodes 200+ vulnerability patterns across 6 languages.

Live Audit: What It Catches

Let me walk through a real audit session. I pointed the skill at a typical FastAPI application and asked for a security review.

What It Found

🔴 CRITICAL: SQL Injection via F-String 

# ❌ Vulnerable code
cursor.execute(f"SELECT * FROM users WHERE id = {user_input}")
Enter fullscreen mode Exit fullscreen mode

The skill immediately flagged this and provided the fix:

# ✅ Parameterized query
cursor.execute("SELECT * FROM users WHERE id = %s", (user_input,))
Enter fullscreen mode Exit fullscreen mode

🔴 HIGH: Insecure Deserialization 

# ❌ Vulnerable
import pickle
data = pickle.loads(untrusted_data)
Enter fullscreen mode Exit fullscreen mode

Fix:

# ✅ Use JSON or validated schemas
import json
data = json.loads(untrusted_data)
Enter fullscreen mode Exit fullscreen mode

🟡 MEDIUM: Hardcoded Secret 

# ❌ Bad
API_KEY = "sk-abc123def456"
Enter fullscreen mode Exit fullscreen mode

Fix:

# ✅ Use environment variables
import os
API_KEY = os.environ.get("API_KEY")
Enter fullscreen mode Exit fullscreen mode

Languages Covered

The skill scans for language-specific vulnerabilities:

Language Vulnerability Types
Python Command injection, SQLi, insecure deserialization, weak crypto
JavaScript/TS XSS, prototype pollution, JWT attacks, eval injection
Go SQL injection, race conditions, path traversal
Rust Unsafe blocks, unwrap misuse
Solidity Reentrancy, access control, unprotected selfdestruct
Java XXE, LDAP injection

The Auth Audit Checklist

One of the most useful features is the authentication audit. Here's a condensed version of the checklist the skill uses:

✅ Passwords hashed with bcrypt (cost ≥ 12) or argon2id?
✅ JWT signed with RS256 (not HS256 for cross-service)?
✅ JWT expiry < 15 minutes for access tokens?
✅ Refresh tokens stored securely (httpOnly, Secure, SameSite=Strict)?
✅ MFA enforced for admin accounts?
✅ Rate limiting on auth endpoints? (≤5 attempts/min)
✅ Account lockout after N failed attempts?
✅ Password reset tokens single-use + expire in 15 min?
Enter fullscreen mode Exit fullscreen mode

Each item links to the specific code pattern to look for and how to fix it.

The API Security Check

For every API endpoint, it checks:

✅ Authentication required
✅ Rate limiting (global + per-endpoint)
✅ Input validation (type, format, length, range)
✅ Output encoding (no raw user data in responses)
✅ CORS configured (specific origins, not *)
✅ CSRF tokens for state-changing requests
✅ No sensitive data in URLs
✅ Request size limits enforced
Enter fullscreen mode Exit fullscreen mode

Why "Fix It Later" Is Dangerous

Most security vulnerabilities aren't complex — they're oversights. That eval(user_input) you left in during debugging. That JWT secret you hardcoded "temporarily". That password stored in MD5 because "the database team said so."

These aren't sophisticated attacks. They're pattern failures. And patterns can be automated.

The Code Security Guardian skill on Gumroad for $10 is my attempt to make security auditing accessible to every developer, not just teams with security budgets.

Getting Started

Installation is simple:

# Clone the skill to your Claude Code directory
mv code-security-guardian ~/.claude/skills/
# Restart Claude Code — it loads automatically
Enter fullscreen mode Exit fullscreen mode

Then just ask:

  • "Audit this Python file for security issues"
  • "Check my JWT authentication implementation"
  • "Review my Dockerfile for security issues"

No API keys needed. Works entirely offline.

Ship secure code. 🛡️

Top comments (0)