Using Claude Code for security reviews (what it catches, what it misses)

I don't rely on Claude Code as a sole security reviewer, but I use it as a fast first pass before code review. It catches a category of issues that are easy to miss when you're close to the code you wrote. The prompt At the end of any session touching auth, user input handling, or data access: Review this code for security issues. Focus on: input validation, authentication bypass paths, data exposure risks, injection vulnerabilities, and insecure defaults. List specific issues with line references, not general advice. The "not general advice" part matters. Without it, Claude produces a list of reminders that don't tell you anything about the actual code. What Claude catches reliably Missing input validation. User-supplied data used without sanitization. Claude spots this consistently. SQL injection patterns. String concatenation in queries, unparameterized inputs — even in ORMs with raw query escape hatches. Exposed sensitive fields. API responses returning password hashes, internal ID