Security Guidance
Real-time security coaching for Claude Code — catches OWASP Top 10 patterns, secrets in code, and dependency vulnerabilities before they reach production.
Install
claude plugins add security-guidance Security Guidance embeds application security knowledge into every Claude Code session. As Claude writes or reviews code, the plugin checks for OWASP Top 10 vulnerability patterns — SQL injection, broken object-level authorisation, insecure deserialization, SSRF, and more — and surfaces findings with CWE references and concrete remediation code.
Secret detection prevents hardcoded credentials from entering commits by recognising common key formats. The dependency auditor cross-references your package manifests against maintained CVE databases. At +26.2% 30-day growth it is the fastest-growing top-20 Claude plugin.
Features
OWASP Top 10
Detects injection, broken auth, SSRF, and other OWASP categories inline.
Secret detection
Flags hardcoded API keys, tokens and credentials before commit.
Dependency audit
Cross-references installed packages with known CVE databases.
Common Use Cases
- Pre-commit security checks
- Auth and session code review
- Dependency risk assessment