The Security Auditor is an agent built to find weak spots before an attacker does.
It reviews code, dependencies, and configuration for known vulnerabilities and insecure patterns.
Unlike a general review, the focus here is narrow: what can actually be exploited.
It surfaces issues like injection, sensitive data exposure, weak authentication, and leaked secrets.
For each finding it describes the risk and suggests a concrete fix.
When to use
- Before shipping anything that handles sensitive data.
- During periodic application security audits.
- When reviewing authentication, permissions, or third-party integrations.
How to use
Ask Claude Code “use the security-auditor to audit this part of the code for vulnerabilities.”