← Back to all free guides
A free guide by Mariah Brunner ↗ INSTAGRAM ↗ TIKTOK

The Free Plugin
That Catches
Unsafe Code

Anthropic made a free Claude Code plugin that checks risky code as it’s being written. If you’re building with AI but can’t read code, this is your safety net. Here’s what it catches and how to turn it on.

So many people are vibe coding now, building real apps with AI without knowing how to read code. The scary part nobody mentions is that if you can’t read it, you have no idea whether what you’re shipping is safe.

Anthropic’s security-guidance plugin for Claude Code watches the code as Claude writes it, flags the dangerous patterns, and gets Claude to fix them in the same session. It’s free to install on every plan, and once it’s on, it just runs.

Turn It On In One Line

Run this once inside a Claude Code session in your terminal. When it asks for a scope, pick user so it loads in every project on your computer.

Run This In Claude Code
/plugin install security-guidance@claude-plugins-official
  1. Use it in a git project. The quick per-edit check works anywhere. The deeper reviews compare against git, so they only run inside a git repository.
  2. Have Python installed. The plugin runs on Python 3.7 or later, and the deeper commit review needs 3.10 or later. Type python3 --version in your terminal to check.
  3. Using the desktop app or VS Code? Install it from the plugins menu there instead.
What It Catches

You don’t need the technical names. Just know it covers the stuff that actually gets people hacked. It checks your code at three points, per Anthropic’s docs.

01

Every edit

An instant pattern check for risky code, like commands an attacker could hijack, unsafe HTML that lets someone inject scripts into your site, and dangerous Python like eval() and pickle. Each warning shows once per pattern per file in a session, so it won’t nag you.

02

End of every turn

A separate Claude reviews everything that changed for deeper problems, like someone seeing data that isn’t theirs or skipping a login check. If it finds something, Claude fixes it as a follow-up and you see both.

03

Every commit

When Claude commits or pushes code, a deeper review reads the surrounding files to confirm a finding is real before reporting it.

Anthropic says that across its internal rollout and benchmarks, PRs opened with the plugin got 30 to 40% fewer security-related review comments. (Help Net Security)

What It Costs

The per-edit check is a simple pattern match, so it’s free. The end-of-turn and commit reviews run on Opus by default and count toward your Claude usage like any other request. If you hit limits faster, that’s why.

When It Flags Something

Don’t just let it scroll by. Paste this so you learn what the risk was and ship the safer version.

Explain And Fix The Warning
The security plugin just flagged something. Help me understand it and fix it safely. I don't read code, so explain it like I'm smart but not technical. 1. In 2 or 3 sentences, tell me what the risk is and what an attacker could actually do with it in my app. 2. Tell me how serious it is for my app specifically: [WHAT YOUR APP DOES AND WHO USES IT, e.g. "a waitlist page that collects emails"]. 3. Fix it the safest way, even if that's more work than the quick fix. Don't remove features to make the warning go away. 4. Show me what you changed in plain words (which file, what it did before, what it does now). 5. Tell me how to test that the app still works. If the warning is a false alarm for my app, say so and explain why instead of changing the code.
Already Built Something?

The plugin only checks code Claude writes from now on. For an app you already have, paste this into Claude Code inside the project before you launch.

Pre-Launch Security Pass
Before I ship this, do a security pass on the whole project. Act like a security reviewer who has to explain things to a non-technical founder. Look for: - Passwords, API keys or secrets written into the code instead of kept in environment variables - Places where user input reaches a database, a shell command or the page without being checked - Pages or data anyone can reach without logging in that should be private - Anything that sends user data somewhere I wouldn't expect For each issue, give me: - Where it is (file name) - What could go wrong, in one plain sentence - Severity: fix before launch, fix soon, or fine for now - Your recommended fix Then fix the "before launch" items one at a time, telling me what you're changing before you do it. Don't touch anything else.

For a deeper scan of a whole project, Anthropic also has a separate Claude Security plugin. It needs a paid plan. Install it with /plugin install claude-security@claude-plugins-official and run /claude-security. Each scan counts toward your usage.

None of this replaces a real security review for anything handling money, passwords or sensitive customer data. For a hobby app or an MVP, it’s a big upgrade. For anything serious, it’s your first line of defense, not your only one.