Claude Code Security-Guidance Plugin: AI-Powered Vulnerability Detection with 30-40% Reduction in PR Security Issues

On May 27, 2026, Anthropic announced the security-guidance plugin for Claude Code—an AI-powered code review tool that catches security vulnerabilities before they reach production. The plugin reviews code across three distinct levels: on file edits, after model turns, and on commits, providing comprehensive security coverage throughout the development workflow.

Available for all Claude Code users through the plugin marketplace (/plugins), the security-guidance plugin represents a significant step forward in automated security review. According to Anthropic's internal data, teams using the plugin have seen a 30-40% reduction in security-related PR comments, demonstrating its effectiveness as a lightweight first pass before human review.

This article breaks down how the security-guidance plugin works, the three review levels it operates on, how to customize it with org-specific rules, and where it fits in your security workflow.

What the security-guidance plugin does

The security-guidance plugin is designed to identify security vulnerabilities automatically as you write code, providing immediate feedback on potential issues before they make it into pull requests or production.

Unlike traditional static analysis tools that run at specific checkpoints, the security-guidance plugin operates continuously throughout your development workflow, catching issues at three critical moments:

1. On file edits — Looks for risky patterns like commonly misused dangerous libraries
2. After model turns — Reviews the full diff for harder-to-spot security issues
3. On commits — Reads surrounding code to validate vulnerabilities in context

This multi-level approach ensures that security issues are caught early and validated thoroughly, reducing false positives while maintaining high detection rates.

Three-level security review explained

Level 1: File edit review

When you edit a file in Claude Code, the security-guidance plugin immediately scans for risky patterns and dangerous libraries. This level focuses on catching obvious security anti-patterns:

• Use of dangerous or deprecated libraries known for security issues
• Common security mistakes like hardcoded credentials
• Risky API patterns that often lead to vulnerabilities
• Known vulnerable code patterns from CVE databases

The file-edit review runs in near real-time, providing instant feedback as you code. This is the fastest and lightest review level, designed to catch low-hanging fruit before you've invested significant time in a particular approach.

Level 2: Model turn review

After Claude Code completes a response or makes changes, the security-guidance plugin performs a comprehensive diff review. This level examines the full context of changes:

• Cross-file security implications
• Subtle vulnerabilities that emerge from code interactions
• Authentication and authorization flow issues
• Data validation and sanitization gaps
• Race conditions and timing vulnerabilities

The model turn review is more computationally intensive than file-edit review but provides deeper analysis by understanding how different parts of your codebase interact. This level catches issues that might not be obvious when looking at individual file changes in isolation.

Level 3: Commit review

Before you commit code, the security-guidance plugin performs its most thorough review, reading surrounding code to validate potential vulnerabilities in full context:

• Validates whether flagged issues are actual vulnerabilities or false positives
• Examines how new code integrates with existing security controls
• Checks for bypass possibilities in authentication/authorization
• Verifies that security assumptions hold across the codebase
• Provides detailed remediation guidance

The commit review level has access to the broadest context and performs verification steps to ensure that reported findings are genuine security issues rather than style suggestions or theoretical concerns.

Installation and setup

Installing the security-guidance plugin is straightforward:

1. Open Claude Code (CLI or Desktop)
2. Run /plugins to access the plugin marketplace
3. Find the security-guidance plugin
4. Install with one click

The plugin is available for all Claude Code users—no special subscription tier required. After installation, it runs automatically via Claude Code's hook system, requiring no additional configuration for basic operation.

To verify the plugin is active, check your hooks configuration or look for security guidance in your next code review.

Customizing with org-specific rules

One of the most powerful features of the security-guidance plugin is organization-specific customization. You can enforce your team's security policies alongside the built-in checks by creating a claude-security-guidance.md file.

Creating a claude-security-guidance.md file

The claude-security-guidance.md file allows you to define custom security rules, coding standards, and prohibited patterns specific to your organization:

# Security Guidance for [Your Organization]

## Prohibited Libraries
- Never use `eval()` or `Function()` constructor
- Avoid deprecated crypto libraries (md5, sha1 for passwords)

## Authentication Requirements
- All API endpoints must use OAuth 2.0 or JWT
- Session tokens must be HttpOnly and Secure

## Data Validation
- All user input must be validated with Zod schemas
- SQL queries must use parameterized statements only

## Secret Management
- Never commit .env files
- Use AWS Secrets Manager for production secrets

Distribution options

You can distribute your claude-security-guidance.md file in two ways:

1. Repository-level — Place the file in your repository root; the plugin will automatically detect and enforce it
2. Organization-level — Distribute via Mobile Device Management (MDM) or configuration management to enforce consistent rules across all repositories

The plugin merges your custom rules with built-in security checks, providing comprehensive coverage tailored to your organization's security posture.

Performance impact and results

According to Anthropic's announcement, the security-guidance plugin has been tested extensively in internal production environments:

• 30-40% reduction in security-related PR comments
• Serves as a lightweight first pass before human review
• Catches issues that would otherwise reach code review
• Reduces back-and-forth in pull requests

The plugin is designed to be fast and non-intrusive, running in the background without slowing down your development workflow. The three-level review system ensures that you get feedback at the right time—immediate for obvious issues, thorough for subtle problems.

How hooks enable the plugin

The security-guidance plugin operates through Claude Code's hook system, which allows plugins to intercept and respond to events like file edits, model responses, and commits.

Hooks provide several advantages:

• Automatic execution — No manual invocation required
• Context awareness — Hooks see the full context of changes
• Flexible configuration — Users can enable/disable specific hook points
• Plugin ecosystem — Standardized interface for all security plugins

If you encounter issues or want to adjust plugin behavior, you can modify hook settings in your Claude Code configuration.

Comparison with other security tools

The security-guidance plugin complements rather than replaces traditional security tools:

The plugin excels at catching issues during active development, when fixes are cheapest and easiest. It works alongside static analysis tools, providing AI-powered reasoning that goes beyond pattern matching.

When to use the security-guidance plugin

The security-guidance plugin is particularly valuable in these scenarios:

1. High-security codebases — Authentication, payments, healthcare, financial services
2. Open-source projects — Catching vulnerabilities before they become public
3. Large teams — Enforcing consistent security standards across developers
4. Rapid development — Maintaining security velocity during fast iteration
5. Educational environments — Teaching developers secure coding practices

Even for smaller projects, the plugin provides valuable security education by explaining why certain patterns are dangerous and how to fix them.

Limitations and considerations

While powerful, the security-guidance plugin has limitations to be aware of:

• AI-powered — May occasionally flag false positives or miss novel vulnerability types
• Not a substitute for security experts, threat modeling, or penetration testing
• Configuration required — Org-specific rules need to be defined and maintained
• Coverage scope — Focuses on code-level vulnerabilities, not infrastructure or deployment issues

Think of the plugin as a security copilot that augments human judgment, not a replacement for comprehensive security programs.

Getting started today

To start using the security-guidance plugin:

1. Install via /plugins in Claude Code
2. Test on a small repository to understand feedback patterns
3. Create a claude-security-guidance.md file with your org's rules
4. Distribute the guidance file across your repositories
5. Monitor PR comments to measure impact
6. Iterate on custom rules based on team feedback

The plugin is available now for all Claude Code users. Documentation is available at code.claude.com/docs/en/plugins/security-guidance.

ExplainX perspective: security as a development workflow

At ExplainX, we teach AI agent development, MCP integration, and security best practices. The security-guidance plugin represents a shift we've been advocating: security as a natural part of the development workflow, not a gate at the end.

Key principles:

• Early detection — Fix issues when they're easiest to address
• Developer education — Learn secure patterns as you code
• Customizable enforcement — Align tools with your security posture
• Layered defense — Combine automated tools with human expertise

The 30-40% reduction in security PR comments is significant, but the real value is cultural: teams that get immediate security feedback develop better instincts over time.

Read next

• Claude Code /ultrareview: cloud bug-hunting fleet
• Agent skills and security threats
• What are agent skills? Complete guide
• MCP servers for security workflows

Plugin features and availability subject to change. Verify current documentation at code.claude.com before implementing in production workflows.