aj7ay/Claude Code Security Reviewer
AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Aug 15, 2025
- License
- MIT
Pinned Snippet
uses: aj7ay/claude-code-review@dd64c5d8d1c6e1b6737488835b04297df843c603 # no releases — HEAD as of 2026-07-10tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| comment-pr | Whether to comment on PRs with findings | no | true |
| upload-results | Whether to upload results as artifacts | no | true |
| exclude-directories | Comma-separated list of directories to exclude from scanning | no | "" |
| claudecode-timeout | Timeout for ClaudeCode analysis in minutes | no | 20 |
| claude-api-key | Anthropic Claude API key for security analysis | yes | "" |
| claude-model | Claude model to use for security analysis (e.g., claude-3-sonnet-20240229) | no | "" |
| run-every-commit | Run ClaudeCode on every commit (skips cache check). Warning: This may lead to more false positives on PRs with many commits as the AI analyzes the same code multiple times. | no | false |
| false-positive-filtering-instructions | Path to custom false positive filtering instructions text file | no | "" |
| custom-security-scan-instructions | Path to custom security scan instructions text file to append to audit prompt | no | "" |
Outputs
| name | description |
|---|---|
| findings-count | Number of security findings |
| results-file | Path to the results JSON file |