Command reference ยท Claude Code
/security-review
Analyzes pending changes on the current branch for security vulnerabilities.
/security-review analyzes the not-yet-committed changes (the Git diff) on the current branch specifically for security risks such as injection, broken authentication, and data leaks, without additional arguments. The diff is determined via the merge base against the source branch; on very old Git versions this failed with a merge-base error until version 2.1.70.
The command is the fast single-pass stage in a multi-stage security chain: the Security Guidance plugin already checks code while it's being written, within the same session; the Claude Security plugin runs a deeper multi-agent scan with independently verified findings and suggested patches; and Code Review additionally evaluates pull requests with full codebase context.
Since version 2.1.108, Claude can also trigger /security-review itself via the Skill tool when it seems relevant in the ongoing conversation, instead of relying solely on a manual invocation by the user.
โ WHEN TO USE IT?
Before merging an auth/secrets feature
Before merging a branch that handles a new API endpoint with user input, run /security-review to check the diff for injection and auth issues.
After adding payment or sensitive-feature code
After payment logic or secret handling has been added to the current branch, use /security-review specifically before the PR.
โ WHEN NOT TO?
General code quality without a security focus
According to the docs, /security-review specifically checks for security risks such as injection, auth issues, data leaks โ not general simplification.
Better: /simplify or /code-review for general quality/bugs.
A deep multi-agent scan of an entire codebase with cross-checked findings and suggested patches is needed
/security-review only delivers a single, fast pass over the current branch diff without independent verification of the findings.
Better: Claude Security plugin (/claude-security) for a multi-agent scan with cross-checked findings and suggested patches.
SOURCES
- Claude Code docs (official) โ code.claude.com
MORE COMMANDS ยท Claude Code