TLDR Tech / InfoSec
Hidden Gaps in Claude Code Security Reviews (10 minute read)
To address a potential issue of model bias when running /security-review in the same session that authored the code, Anthropic introduced a new plugin that runs a separate session to review the diff. The author hypothesized and proved that the /security-review skill suffers from model bias, ignoring legitimate findings due to existing context from the authoring process, and that the plugin misses complex attack chains because it is limited to changes in the specific diff. The author suggests running /security-review manually in a new session to force a full code review without model bias and avoid these issues.
Read the full story