Ask Claude to Run a Security Audit on Your Codebase

Static analysis tools catch patterns. Claude catches intent. Ask it to audit your codebase for security issues and it reads the actual logic — following data from user input through to database queries, checking auth middleware coverage, and spotting trust boundary violations.

Audit src/ for security vulnerabilities. Check for SQL injection, XSS, 
CSRF, hardcoded secrets, missing authentication, and insecure defaults. 
Report each finding with the file, line number, and a suggested fix.

Claude reads the code paths end-to-end, not just individual files. It catches issues that pattern-matching tools miss — like an input that's validated in the controller but used unsanitised in a different service that receives it via a queue.

Focus the audit on specific threat categories:

# Input validation
Check all API endpoints for missing or insufficient input validation. 
Which fields accept user input without sanitisation?

# Authentication and authorisation
Find routes that are missing auth middleware or endpoints where 
authorisation checks can be bypassed.

# Secrets exposure
Search for hardcoded API keys, tokens, passwords, and connection strings 
anywhere in the codebase — including config files, comments, and test fixtures.

# Dependency vulnerabilities
Check package.json (or composer.json, requirements.txt) for packages 
with known security issues. Suggest the minimum version upgrade to fix each one.

For the highest-value results, point Claude at your most sensitive code first:

Focus on the payment processing code in src/billing/ and the 
authentication flow in src/auth/. These handle money and credentials — 
flag anything that doesn't follow defence-in-depth principles.

After the audit, ask Claude to fix the findings one by one — it already knows where the issues are and what the fix should be.

A security audit that reads your actual code paths is worth more than a thousand generic checklist items.

via Claude Code