leonmelamud/Claude Code Security Reviewer
AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 1, 2026
- License
- None
Pinned Snippet
uses: leonmelamud/claude-code-security-review@324fba2e5967be5ae322e8df977a1dc0a3d23883 # #securitytags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| comment-pr | Whether to comment on PRs with findings | no | true |
| upload-results | Whether to upload results as artifacts | no | true |
| exclude-directories | Comma-separated list of directories to exclude from scanning | no | "" |
| claudecode-timeout | Timeout for ClaudeCode analysis in minutes | no | 20 |
| claude-api-key | Anthropic Claude API key for security analysis | yes | "" |
| claude-model | Claude model to use for security analysis (e.g., claude-sonnet-4-20250514) | no | "" |
| run-every-commit | Run ClaudeCode on every commit (skips cache check). Warning: This may lead to more false positives on PRs with many commits as the AI analyzes the same code multiple times. | no | false |
| false-positive-filtering-instructions | Path to custom false positive filtering instructions text file | no | "" |
| custom-security-scan-instructions | Path to custom security scan instructions text file to append to audit prompt | no | "" |
Outputs
| name | description |
|---|---|
| findings-count | Number of security findings |
| results-file | Path to the results JSON file |