Code review & security

Using Claude to audit your code before it ships

Claude as your security auditor

Before pushing code to a client site, having Claude do a security and quality audit is a high-ROI 10-minute investment. It catches things humans commonly miss — input validation gaps, exposed credentials, common injection vectors.

General code quality review

"Review the code in /src/api/orders.js for:
1. Code quality — is it readable, maintainable, well-organized?
2. Error handling — are all failure paths handled?
3. Performance — any obvious bottlenecks or N+1 problems?
4. Testing — are edge cases covered in tests?

Be direct about what's wrong, not just what could be better."

Security audit

"Do a security audit of /src/webhooks/ and /src/api/. Look specifically for:
- SQL injection vulnerabilities (parameterized queries used everywhere?)
- Input validation gaps (is all user input validated before use?)
- Authentication gaps (is every endpoint that should be protected, protected?)
- Exposed sensitive data in logs or responses
- CORS misconfiguration

For each issue found: describe the vulnerability, the risk, and the fix."

WordPress-specific security review

"Review this WordPress plugin code for:
- Proper nonce verification on all forms
- Capability checks (current_user_can) before privileged actions
- Proper sanitization (sanitize_text_field, esc_html, etc.)
- Direct database queries using wpdb->prepare()

[paste plugin code or point to files]"

Dependency review

"Check our package.json dependencies:
1. Run npm audit and summarize critical/high vulnerabilities
2. Identify packages that haven't been updated in 2+ years
3. Flag any packages with known security issues"