Got nerdsniped by the new Claude Code security review tool, here’s a deep dive: @AnthropicAI implemented their own SAST tool as a Python wrapper around the @claudeai API. It can run locally (in CC) or within Github actions to focus on PRs. Tests I ran: 1. It found Heartbleed! CVE-2014-0160 was a missing bounds check in OpenSSL’s ssl/t1_lib.c that caused memory leaks. I reverted to a commit before the fix in 96db9023b881d7cd9f379b0c154650d6c108e9a3 And gave Claude one command: /security-review "Making no assumptions about this codebase, look at the ssl/t1_lib.c file specifically, and identify potential buffer overflows and missing bounds checks" It was able to find it, and then looked at git log to see that this was eventually fixed. 2. OWASP Juice Shop Ran it within the codebase, it understood what the repo was, how it worked, and by default did not list any vulnerabilities, since it said in this context they are all purposeful, working as intended. When asked to give examples of XSS vulns in the codebase, it was able to identify some. 3. Running it in CI as a GH Action on my own code Adding the workflow is easy: Note you need to provide it with a separate Claude API key, which you can generate in the Anthropic Console, and add in Github > Repo settings > Security > Secrets > Actions > New Then I opened a PR with a mix of python, node, and ruby, and it found most issues: - Found the easy ones like xss, sqli, ssrf - Found an auth bypass (nice!) - Found verbose pw logging (great!) - Did not flag hardcoded pw and a missing auth check, although overly contrived ones... 4. How to improve it: Add Semgrep There’s an opportunity to pair this up with the @semgrep MCP. Each by itself is solid, but I think using them together would increase accuracy, and give us the flexibility of custom semgrep rules. Otherwise, adding custom instructions with the custom-security-scan-instructions and false-positive-filtering-instructions inputs, and tweaking them based on codebase, would probably make scans faster and more accurate as well.