Security audit

Check before you launch

Before you launch something that handles user data or payments, you want to know it's solid. Inside Claude Code, type /security. The system spawns multiple agents, each focused on a specific attack surface.

This isn't a linter warning. These agents actually test your application. They try SQL injection on your inputs. They check for cross-site scripting in your output. They verify your auth tokens can't be forged. They confirm your database policies don't leak data across users.

What happens

Each agent owns a specific category of vulnerabilities. They read your codebase, identify where attacks could land, and run targeted tests against your local server. They check your environment variables aren't exposed. They verify your API routes validate input. They confirm your database queries are safe.

What you get back

A report with findings ranked by severity. Every issue includes the specific file and line where the problem is. Things the agents can safely fix get patched automatically. Things that need your judgment are flagged with an explanation and a recommendation.

When to run this

Before your first deploy to production. After adding features that touch authentication, payments, or personal data. Before any launch that puts real user information at stake.

Inside Claude Code, just type:

/security

The system knows your codebase. You don't need to tell it what to check.