Install command
Provided
commandsSource-backedReview first Safety ✓ Privacy ✓
/security-audit - Security Scanner Command for Claude Code
Deploy 100 specialized sub-agents for comprehensive enterprise-grade security, performance, and optimization audit of production codebase
HarnessClaude Code
Invocation:/security-audit [scope]
Review first — review before installing
Open the source and read safety notes before installing.
Citation facts
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
- Canonical URL
- https://heyclau.de/entry/commands/security-audit
- Source URLs
- https://code.claude.com/docs/en/slash-commands, https://github.com/JSONbored/awesome-claude/blob/main/content/commands/security-audit.mdx
- Safety notes
- Review generated changes and commands before applying them; slash commands can ask the agent to read, write, edit, or run tools in the current project., Limit scope to the intended files and run in a trusted checkout when the command analyzes code, tests, security findings, or generated output.
- Privacy notes
- Prompts, source files, logs, errors, dependency metadata, and generated reports may be sent to the configured AI model during command execution., Redact secrets, customer data, private repository details, and proprietary code before sharing command output outside the workspace.
- Author
- JSONbored
- Claim status
- unclaimed
- Last verified
- 2025-10-25
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
78
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
CompleteConfirm ownership and provenance before trusting install instructions.
- Done
Source link availableRequired
Open the canonical repository and verify ownership.
- Done
Source provenance statusRequired
Marked as source-backed.
- Done
Metadata reviewed
Registry metadata indicates a reviewed listing.
Safety and privacy checks
CompleteValidate risk disclosures before installation or API wiring.
- Done
Safety notes presentRequired
Review the listed safety guidance before running commands.
- Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
- Done
Trust level risk gateRequired
Trust level does not block evaluation.
Package and install checks
Needs reviewCheck package metadata and artifact integrity signals.
- Done
Install payload available
Install or copy payload is available for review.
- Pending
Package verification flag
No package verification flag provided.
- Pending
Checksum metadata
No checksum provided for downloaded artifact.
Compare-driven decision checks
Needs reviewUse compare context to validate trade-offs before adoption.
- Pending
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
- Pending
Baseline comparison available
No baseline peer selected yet.
- Pending
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
CLI install
Copy-ready — paste the snippet to get started.
Config snippet
Not provided
Copy snippet
Provided
Prerequisites
None
Platforms
1 listed
Difficulty
100/100
Adoption plan
Balanced adoption plan
Current risk score 16/100. Use staged verification before broader rollout.
Pre-adoption checks
Validate source and review signals before any execution.
- Done
Confirm source provenanceRequired
Source URL/provenance metadata is present.
- Done
Confirm metadata review state
Listing has review metadata.
- Done
Verify install payload
Install/config payload exists and can be inspected.
Security checks
Confirm safety, privacy, and package integrity signals.
- Done
Review safety notesRequired
Safety notes are present.
- Done
Review privacy notesRequired
Privacy notes are present.
- Pending
Verify package integrity metadata
No package verification/checksum metadata.
Rollout
Adopt in controlled steps based on the selected plan.
- Pending
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
- Pending
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
- Pending
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Evidence readiness matrix · balanced
Required evidence gates are covered (5/6 signals complete).
Source provenance
PresentSource repository/provenance is listed.
Required in this preset
Metadata review
PresentReview metadata is present.
Required in this preset
Safety notes
PresentSafety notes are present.
Required in this preset
Privacy notes
PresentPrivacy notes are present.
Optional in this preset
Package integrity
MissingPackage integrity metadata is missing.
Optional in this preset
Install payload
PresentInstall payload is available.
Required in this preset
Required evidence gates are covered for this preset.
Decision timeline
Decision timeline · balanced
5/6 steps complete with no blocking gaps for this preset.
triage
Confirm source provenanceRequired
Source/provenance metadata is available.
triage
Check metadata review statusRequired
Review metadata is available.
verify
Review safety notesRequired
Safety notes are available.
verify
Review privacy notes
Privacy notes are available.
verify
Validate package integrity metadata
Package integrity metadata is missing.
rollout
Verify install payload and commandsRequired
Install payload is available.
No required blockers for this timeline preset.
Safety & privacy surface
Safety & privacy surface
2 safety and 2 privacy notes across 4 risk areas. Review closely: credentials & tokens, permissions & scopes, third-party handling.
- SafetyExecution & processesReview generated changes and commands before applying them; slash commands can ask the agent to read, write, edit, or run tools in the current project.
- SafetyPermissions & scopesLimit scope to the intended files and run in a trusted checkout when the command analyzes code, tests, security findings, or generated output.
- PrivacyThird-party handlingPrompts, source files, logs, errors, dependency metadata, and generated reports may be sent to the configured AI model during command execution.
- PrivacyCredentials & tokensRedact secrets, customer data, private repository details, and proprietary code before sharing command output outside the workspace.
Safety notes
- Review generated changes and commands before applying them; slash commands can ask the agent to read, write, edit, or run tools in the current project.
- Limit scope to the intended files and run in a trusted checkout when the command analyzes code, tests, security findings, or generated output.
Privacy notes
- Prompts, source files, logs, errors, dependency metadata, and generated reports may be sent to the configured AI model during command execution.
- Redact secrets, customer data, private repository details, and proprietary code before sharing command output outside the workspace.
Schema details
- Install type
- cli
- Reading time
- 7 min
- Difficulty score
- 100
- Troubleshooting
- Yes
- Breaking changes
- No
Runtime and command metadata
- Command syntax
- /security-audit [scope]
Full copyable content
/security-audit [scope]About this resource
The /security-audit command deploys 100 specialized virtual sub-agents to conduct a comprehensive enterprise-grade audit of your entire codebase. Each agent operates as a world-class expert in their domain, examining every line of code with the mindset that hostile actors have full visibility to your public repository.
Features
- 100 Specialized Sub-Agents: Each agent is an expert in specific security, performance, and optimization domains
- Enterprise-Grade Analysis: Line-by-line examination assuming hostile actor visibility
- Comprehensive Scoring: 0-100 scores across 10+ major categories with detailed justification
- Resource Optimization: Maximizes free tier usage (Upstash Redis, Arcjet, Vercel) without reducing functionality
- Prioritized Recommendations: Critical, High, Medium, and Low priority actionable items
- Implementation Roadmap: Quick wins, short-term, medium-term, and long-term improvement plans
Usage
/security-audit [scope]
Parameters
scope(optional): Specific focus area - defaults to "all"all- Full comprehensive audit (default)security- Focus on security specialistsperformance- Focus on performance optimization
Sub-Agent Categories
Security Specialists (15 agents)
- Authentication Security
- Content Security Policy
- Input Validation
- API Security
- Dependency Security
- Environment Security
- Transport Security
- Client-Side Security
- Server Security
- Third-Party Security
- Bot Protection
- DDoS Protection
- Information Disclosure
- Access Control
- Cryptographic Security
Performance Specialists (12 agents)
- Core Web Vitals
- Bundle Optimization
- Image Optimization
- Font Optimization
- CSS Performance
- JavaScript Performance
- Caching Strategy
- Database Performance
- Network Performance
- Rendering Performance
- Memory Management
- Mobile Performance
Code Quality Specialists (10 agents)
- TypeScript Excellence
- React Best Practices
- Code Architecture
- Error Handling
- Testing Coverage
- Code Consistency
- Documentation Quality
- Maintainability
- Accessibility Compliance
- Refactoring Opportunities
SEO & Content Specialists (8 agents)
- Technical SEO
- Page Speed SEO
- Content Structure
- Schema Markup
- Sitemap Optimization
- Internal Linking
- Mobile SEO
- International SEO
Infrastructure Specialists (10 agents)
- Vercel Optimization
- Redis Utilization
- CDN Strategy
- Build Process
- Environment Management
- Monitoring & Observability
- Backup & Recovery
- Scalability Planning
- Resource Allocation
- Deployment Strategy
Business Logic Specialists (8 agents)
- Data Flow Architecture
- API Design
- User Experience Flow
- Content Management
- Search Functionality
- Analytics Integration
- Third-Party Integrations
- Feature Flag Management
Compliance & Standards Specialists (7 agents)
- Privacy Compliance
- Web Standards
- Browser Compatibility
- Progressive Web App
- Internationalization
- Content Security
- Legal Compliance
Optimization Specialists (10 agents)
- Asset Optimization
- Database Query Optimization
- Memory Optimization
- Network Optimization
- Storage Optimization
- Computational Optimization
- Resource Loading
- Third-Party Optimization
- Mobile Optimization
- Accessibility Optimization
Maintenance & Operations Specialists (8 agents)
- Dependency Management
- Code Organization
- Configuration Management
- Logging & Debugging
- Health Monitoring
- Backup Strategies
- Documentation Maintenance
- Version Control
Specialized Audit Agents (12 agents)
- Dead Code Detection
- Performance Regression
- Security Vulnerability Scanning
- Lighthouse Audit
- Bundle Analysis
- Accessibility Audit
- SEO Technical Audit
- Mobile Audit
- Loading Performance
- Code Duplication
- Configuration Audit
- Overall Architecture Review
Examples
Full Comprehensive Audit
/security-audit
# Deploys all 100 sub-agents for complete analysis
Security-Focused Audit
/security-audit security
# Focuses on 15 security specialists + related infrastructure agents
Performance-Focused Audit
/security-audit performance
# Focuses on 12 performance specialists + optimization agents
Audit Deliverables
Executive Summary
- Overall assessment and critical findings
- Risk assessment and impact analysis
- Strategic recommendations overview
Category Scores (0-100 scale)
- Security Score: Vulnerability breakdown by type
- Performance Score: Core Web Vitals and optimization analysis
- Code Quality Score: Maintainability and technical debt metrics
- SEO Score: Technical SEO compliance assessment
- Scalability Score: Resource efficiency and scaling readiness
- Accessibility Score: WCAG compliance level evaluation
- Infrastructure Score: Cloud optimization and deployment assessment
- Compliance Score: Standards adherence and regulatory compliance
- Maintainability Score: Technical debt and code organization
- Optimization Score: Resource utilization efficiency
Prioritized Recommendations
Critical Issues (Immediate Action Required)
- Security vulnerabilities with high CVSS scores
- Performance blockers affecting Core Web Vitals
- Compliance violations with legal implications
High Priority (Significant Impact)
- Architecture improvements for scalability
- Security hardening recommendations
- Performance optimizations with measurable impact
Medium Priority (Notable Optimizations)
- Code quality improvements
- SEO enhancements
- Resource utilization optimizations
Low Priority (Minor Enhancements)
- Documentation improvements
- Code style consistency
- Development workflow optimizations
Resource Optimization Plan
Redis Utilization (Upstash Free Tier)
- Caching strategies to maximize free tier
- Memory optimization techniques
- Connection pooling recommendations
Arcjet Optimization (500k requests/month free)
- Enhanced security within free limits
- Rate limiting optimization
- Bot protection configuration
Vercel Efficiency (Preparation for Free Tier)
- Build optimization for faster deployments
- Function optimization for reduced execution time
- Bandwidth optimization strategies
Implementation Roadmap
Quick Wins (0-1 week)
- Configuration adjustments
- Security header implementations
- Basic performance optimizations
Short Term (1-4 weeks)
- Code refactoring projects
- Infrastructure improvements
- Testing implementation
Medium Term (1-3 months)
- Architecture modernization
- Advanced security implementations
- Performance monitoring setup
Long Term (Strategic)
- Scalability architecture
- Advanced compliance implementation
- Enterprise feature development
Audit Methodology
Analysis Depth
- Line-by-line examination of entire codebase
- Configuration review of all deployment and build settings
- Dependency analysis for security and performance implications
- Architecture assessment for scalability and maintainability
Security Mindset
- Assumes hostile actors have full repository visibility
- Evaluates every public code line for potential exploitation
- Tests for OWASP Top 10 and emerging threat vectors
- Assesses supply chain security and dependency risks
Resource Optimization Focus
- Maximizes free tier efficiency across all services
- Identifies opportunities to reduce paid service usage
- Optimizes for cost-effective scaling strategies
- Maintains all existing functionality during optimization
Scoring System
- 0-100 scale with detailed justification for each score
- Industry benchmarks comparison for context
- Weighted scoring based on security and business impact
- Trend analysis for performance regression detection
Technical Stack Context
Current Technology Stack
- Framework: Next.js 15.5.4 with React Compiler
- Language: TypeScript with strict mode
- Styling: TailwindCSS with custom design system
- UI Library: shadcn/ui + Radix UI components
- Security: Arcjet middleware (500k requests/month free tier)
- Cache: Upstash Redis (free tier via Vercel Marketplace)
- Hosting: Vercel (currently paid, planning free tier migration)
- Content: MDX-based content management system
- Database: Static generation with optional dynamic content
Deployment Constraints
- Public Repository: Every line visible to potential attackers
- Resource Limits: Must optimize for free tier usage
- Performance Requirements: Core Web Vitals compliance
- Security Standards: Enterprise-grade for open-source project
- Scalability: Prepared for traffic growth within free tiers
This comprehensive audit ensures your production codebase meets enterprise security standards while optimizing for maximum efficiency within free tier constraints.
Source citations
Add this badge to your README
Show that /security-audit - Security Scanner Command for Claude Code is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/commands/security-audit)How it compares
/security-audit - Security Scanner Command for Claude Code side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
| Field | Deploy 100 specialized sub-agents for comprehensive enterprise-grade security, performance, and optimization audit of production codebase Open dossier | Advanced performance optimization with bottleneck analysis, memory profiling, and automated improvements Open dossier | Intelligent code refactoring command that analyzes code structure and applies best practices for improved maintainability and performance Open dossier | Comprehensive code review with security analysis, performance optimization, and best practices validation Open dossier |
|---|---|---|---|---|
| Next steps | ||||
| Trust | ||||
| Review status | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed |
| Package trust | Package not verified | Package not verified | Package not verified | Package not verified |
| Source provenance | Source-backed | Source-backed | Source-backed | Source-backed |
| Submitter | — | — | — | — |
| Install risk | Review first | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | — | — | — | — |
| Category | commands | commands | commands | commands |
| Source | source-backed | source-backed | source-backed | source-backed |
| Author | JSONbored | JSONbored | JSONbored | JSONbored |
| Added | 2025-10-25 | 2025-09-16 | 2025-09-16 | 2025-09-16 |
| Platforms | Claude Code | Claude Code | Claude Code | Claude Code |
| Source repo | — | — | — | — |
| Safety notes | ✓Review generated changes and commands before applying them; slash commands can ask the agent to read, write, edit, or run tools in the current project. Limit scope to the intended files and run in a trusted checkout when the command analyzes code, tests, security findings, or generated output. | ✓Review generated changes and commands before applying them; slash commands can ask the agent to read, write, edit, or run tools in the current project. Limit scope to the intended files and run in a trusted checkout when the command analyzes code, tests, security findings, or generated output. | ✓Review generated changes and commands before applying them; slash commands can ask the agent to read, write, edit, or run tools in the current project. Limit scope to the intended files and run in a trusted checkout when the command analyzes code, tests, security findings, or generated output. | ✓Review generated changes and commands before applying them; slash commands can ask the agent to read, write, edit, or run tools in the current project. Limit scope to the intended files and run in a trusted checkout when the command analyzes code, tests, security findings, or generated output. |
| Privacy notes | ✓Prompts, source files, logs, errors, dependency metadata, and generated reports may be sent to the configured AI model during command execution. Redact secrets, customer data, private repository details, and proprietary code before sharing command output outside the workspace. | ✓Prompts, source files, logs, errors, dependency metadata, and generated reports may be sent to the configured AI model during command execution. Redact secrets, customer data, private repository details, and proprietary code before sharing command output outside the workspace. | ✓Prompts, source files, logs, errors, dependency metadata, and generated reports may be sent to the configured AI model during command execution. Redact secrets, customer data, private repository details, and proprietary code before sharing command output outside the workspace. | ✓Prompts, source files, logs, errors, dependency metadata, and generated reports may be sent to the configured AI model during command execution. Redact secrets, customer data, private repository details, and proprietary code before sharing command output outside the workspace. |
| Prerequisites | — none listed | — none listed | — none listed | — none listed |
| Install | | | | |
| Config | — | — | — | — |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Related guides
Source-backed guides for putting this to work.
guides
Fix Claude Code Performance
Fix Claude Code high CPU/memory, hangs, and context bloat with documented commands.
Review firstSource-backedReview firstAdded 8mo ago
Safety ✓ Privacy ✓by JSONboredSignals
Loading live community signals…
More like this, weekly
A short, calm digest of reviewed Claude resources. Unsubscribe any time.