anthropics/claude-code-security-review
Claude Code Security Review
Acest proiect este un instrument de analiză statică bazat pe AI și un scaner automat de vulnerabilități conceput pentru a detecta defectele de securitate, cum ar fi injecția și ocolirea autentificării. Utilizează modele de limbaj mari pentru a efectua raționamente semantice în mai multe limbaje de programare, identificând vulnerabilitățile în cadrul modificărilor de cod.
Instrumentul operează ca un GitHub Action care se integrează în pipeline-urile de integrare continuă pentru a analiza diff-urile pull request-urilor. Se concentrează pe liniile de cod modificate pentru a viza riscurile noi și raportează constatările prin postarea de comentarii automate direct în pull request.
Analiza este direcționată de politici de securitate personalizabile și injecția de reguli externe, permițând instrucțiuni specifice proiectului. Aceste reguli și filtre personalizate sunt utilizate pentru a reduce zgomotul și a elimina constatările cu impact redus pentru a prioritiza riscurile de securitate cu încredere ridicată.
Features
- LLM-Based Analysis - Uses large language models to evaluate code intent and semantic context to identify security flaws.
- Vulnerability Scanners - Provides an automated scanner that identifies security risks and insecure coding practices within source code using semantic reasoning.
- AI-Powered Code Analysis Tools - Utilizes large language models to analyze source code for complex security vulnerabilities like injection attacks.
- Diff-Based Change Isolation - Analyzes only modified code blocks within a diff to target new vulnerabilities for AI evaluation.
- Vulnerability Reporting Integrations - Notifies developers of detected vulnerabilities by posting automated comments directly onto pull requests.
- Vulnerability Review Scanners - Scans code changes in pull requests for security issues and displays results during the review process.
- GitHub Actions Workflows - Operates as a managed workflow that triggers on pull requests and communicates via automated API comments.
- Security Linters - Implements a customizable AI-driven security linter that applies project-specific instructions and filters to reduce noise during analysis.
- Security Vulnerability Scanning - Scans source code differences in pull requests to detect common security flaws and vulnerabilities.
- AI-Powered Code Auditing - Uses large language models to scan code for complex security vulnerabilities such as authentication bypasses.
- Pull Request Vulnerability Scanning - Analyzes specific code changes in a diff to identify new security risks without scanning the entire codebase.
- CI Pipeline Integration - Integrates automated vulnerability scanning directly into the continuous integration build process.
- External Rule Management - Loads behavioral constraints and decision logic from external text files to steer the AI analysis process.
- Security Scanning Rules - Directs the analysis process by adding project-specific security instructions and filtering rules through external files.
- AI Scan Policies - Applies project-specific rules and filters to AI security scans to reduce false positives.
- Security Scan Policy Enforcers - Applies project-specific rules and filters to AI scans to reduce false positives and prioritize critical findings.
- False Positive Filtering - Applies custom constraints to discard low-impact findings and focus on high-confidence security risks.
