AI agent security review workflow
Use an AI coding agent to review auth, authorization, inputs, secrets and payment changes before shipping.
Quick answer
A security review agent should check identity sources, object ownership, validation, secrets, logs and billing side effects before approval.
Workflow
Scan changed routes and actions, verify session-derived user IDs, inspect external inputs, look for secret exposure and confirm tests for user-scoped access.
Risk check
Security review fails when the agent only comments on style and misses IDOR, unsafe env access or unbounded external calls.
FAQ
Can an AI agent do security review?
It can find many repeatable issues, but high-risk changes still need explicit human judgment and targeted tests.
Review security with agents
Related guides
CLAUDE.md: A Guide for Every Developer
One markdown file that makes AI coding assistants actually understand your codebase. Here's what to put in it.
There's a reason Claude Code writes great code in some projects and generic boilerplate in others. It's not the model. It's CLAUDE.md . It is one part of my Claude Code workflow: project conventions reduce guesswork, but they do not guarantee a speedup or remove the need to review the change. What it is CLAUDE.md is a plain markdown file that Claude Code reads at the start of every session. Think of it as the onboarding doc you'd give a senior contractor on day one: stack, conventions, rules, context. Without it, Claude infers patterns from what it sees in the codebase. Sometimes it infers correctly. Often it doesn't especially for implicit conventions your team just "knows". With a good CLAUDE.md , Claude outputs code that follows your rules without being told each time. What to put in it 1. Stack and versions Simple but important. Claude will use the right…
Read the guide5 Claude Code Hooks I Use Daily
Claude Code hooks run shell commands on session start, file writes, and tool calls. Here are the 5 I use daily and how to configure them.
Most people discover Claude Code for the AI. They miss the hooks. Hooks are shell commands that execute automatically when something happens in your Claude Code session: a session starts, a tool runs, Claude stops. You define them in .claude/settings.json . They run silently in the background. Here are the 5 I use every day. What hooks look like The available events: SessionStart , UserPromptSubmit , PreToolUse , PostToolUse , Stop . Hook 1 Auto inject date on every prompt Event : UserPromptSubmit Claude doesn't have real time awareness. Every prompt gets the current date injected automatically. Useful for anything time sensitive: changelogs, deadlines, scheduling logic. Hook 2 Push notification when Claude stops Event : Stop Long tasks (refactors, test runs, analysis) can take 2–5 minutes. Without a notification I'd either stare at the screen or miss the result. This fires whenever Claude finishes a task, whether it succeeded or…
Read the guideClaude Code Agents: When to Use Them
Claude Code Agents (subagents) let you spawn isolated work threads from the main session. Full guide: what they are, when to use them, how to write a custom one, and the patterns that actually ship.
Claude Code is great when you're driving one thread of work. When you need to run three threads in parallel, or want a fresh pair of eyes on a decision, or need to scope out a large refactor without polluting your main session that's what Agents are for. This is what Claude Code Agents actually are, when to use them, and how to write your own. What Claude Code Agents actually are An Agent (sometimes called a subagent) is an isolated work thread you spawn from the main Claude Code session via the Agent tool. It has its own context fresh, with no visibility into your conversation. You hand it a self contained prompt; it does the work; it returns a single message at the end. Three things make this different from just asking Claude another question: 1. Isolated context. The agent doesn't see what you've been doing. It can't…
Read the guide