About to Open a Pull Request? Run /security-review in Claude Code First.

At a glance

• Run /security-review in Claude Code to check the changes on your branch for injection, auth and data exposure risks before a reviewer sees them.
• If the review stops because the origin default branch ref is missing, fetch and set that ref with two git commands.
• Know where it fits next to /code-review and the Claude Security plugin.

Your feature branch is done and the tests pass. The next stop is a pull request. Claude Code has a command for one more pass before you open it. This is a security pass on the branch diff, not the correctness review we covered in Cap the Findings on Local /code-review.

Why it matters

The commands reference describes /security-review as a review of the diff between your branch and the default branch on origin, looking for risks like injection, auth issues and data exposure. It sits in the docs' "Before you ship" group next to /diff and /code-review, which checks the diff for correctness bugs. The security guidance page calls it a single pass on the current branch. It covers only your branch's changes, and it needs a git ref that single branch and CI checkouts lack.

How to run /security-review on your branch

We built these steps from Anthropic's docs and have not run them in a live session.

1. Work on a feature branch in a repository with an origin remote.
2. If origin/HEAD is missing, run git fetch origin and then git remote set-head origin --auto, which asks the remote for its default branch.
3. If --auto fails, name the branch yourself with git remote set-head origin main, using your real default branch. In a single branch clone, the docs say to add the branch with git remote set-branches --add origin main and fetch first.
4. Start Claude Code in the repository and type /security-review. Read each finding, then ask Claude to fix the ones you agree with.

# We have not run this script end to end on every platform.
# Run it from your repository folder. Replace main with your default branch.
# The git commands below are commented so this script does not change any refs.

claude --version

# Missing origin/HEAD? Ask the remote which branch is its default
# git fetch origin
# git remote set-head origin --auto

# If --auto fails, name the branch yourself
# git remote set-head origin main

# Single branch clone? Widen what you fetch, then rerun set-head
# git remote set-branches --add origin main
# git fetch origin
# git remote set-head origin main

# Then start claude and type at its prompt:
#   /security-review

Gotchas

• The review stops if the origin default branch ref is missing. The errors reference says git cannot resolve that ref, and the message can mention a failed shell pattern or an ambiguous git argument. It may also mention a git log or a different git diff.
• An empty remote gives an empty review. If you push your branch first and point origin/HEAD at it, the docs say the review sees an empty diff until your branch moves past it.
• It reviews your branch only. For code you already have, the security guidance page suggests asking Claude to review a file or folder, or the Claude Security plugin for a deeper multi agent scan. The security guidance plugin reviews Claude's own edits during the session.

Sources:

• Commands, Claude Code docs
• Error reference, Claude Code docs
• Security guidance, Claude Code docs
• Security, Claude Code docs
• Claude Security plugin
• Cap the Findings on Local /code-review

Recommended AI prompt

Copy this paragraph into ChatGPT, Claude, Gemini, Grok, or whatever AI you use.