Real-Time Bug Patrol: Install Claude Code's security-guidance Plugin and Let It Fix Vulnerabilities as You Write

One /plugin install command adds a three-layer security reviewer that catches injections, XSS, and unsafe deserializations before you even finish a turn — no commands to invoke, no CI wait.

The security-guidance plugin runs as a pre-tool hook on every edit. Once installed, it's invisible — until it finds something. Then it feeds the finding back to Claude in the same context so Claude rewrites the code in the same turn before you see the response.

Install

/plugin install security-guidance@claude-plugins-official
/reload-plugins

Requires Claude Code ≥ v2.1.144. Free on all Claude plans.

Three-layer review

Layer 1 — Per-edit regex scan (instant, zero cost): catches known-bad patterns before an edit lands. Fast enough to fire on every change without slowing the session.

Layer 2 — End-of-turn LLM diff review: at the end of each turn, sends the full diff to Opus 4.7, which surfaces high-severity findings and returns them to Claude's context. Claude typically rewrites before responding.

Layer 3 — Agentic commit-time review: wired to a git pre-commit hook, this does a cross-file analysis across files touched in the commit — the layer that catches issues that only become visible in context.

What it catches

25 vulnerability classes, including: command injection in shell calls and GitHub Actions YAML, eval() / new Function(), XSS via innerHTML / dangerouslySetInnerHTML, Python pickle.loads(), SSRF patterns, hardcoded secrets, and path traversal.

What it doesn't do

Not a SAST replacement — it won't catch complex multi-file business logic flaws. Use it as a fast first pass and schedule a dedicated /security-review scan periodically for deeper analysis.

Custom patterns are configurable via security-guidance.json in your repo root; you can add domain-specific checks (internal API misuse, proprietary auth patterns) using the same regex + LLM spec format.

Sources: Claude Code security-guidance docs — code.claude.com · Plugin page — claude.com · Security-guidance plugin guide — apito.ai · MarkTechPost: Claude Security Plugin in beta (Jul 22)