Claude Code writes code that works, but it never asks whether that API route checks who’s calling, or whether that Supabase key bypasses RLS. Unless you ask, it doesn’t come up. So I built a small MCP server that runs security scanners locally (Opengrep, Gitleaks, npm audit, Trivy). After a change I say “scan what you changed” and Claude reads the findings and fixes them in the same session. That’s the part that matters. When I had to read a report myself, I mostly didn’t bother. Two things I learned building it with Claude Code:
- Make it show a failing test before the fix. Every time I skipped that, a bug shipped.
- Be explicit. “Make it secure” does nothing. “Only the owner can read this row” works every time. It’s called SafeWeave, I’m the author. Happy to share the repo if anyone wants it. How do you all handle security with Claude Code? Flair: Built with Claude Code submitted by /u/nickjee001
Originally posted by u/nickjee001 on r/ClaudeCode
You must log in or # to comment.