Follow Discord
Sweep 22 Oct 2026 · 04:32Z Build v2.1.308 527 read Stable v2.1.308 Latest v2.1.308 Next v2.1.308 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeDocsClaude Code CLI 9 Oct 2026
One change · claude-code

Catch security issues as Claude writes code changedsecurity-guidance

Nearest release: v2.1.296, published 3 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Upstream edited this page at 9 Oct 2026 20:45 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 9 Oct 2026 21:07 UTC.

Upstream edited
Recorded here
Lines+9added
Lines−3removed
From line 62 where the diff opens
First seen 14 Aug 2026 this site's first read of the page
Recorded edits15to this page, all time

### Checks on each file edit ### Checks at the end of each turn ### Checks on each commit or push Claude makes ### On each file edit ### At the end of each turn ### On each commit or push Claude makes

The whole hunk

from line 62, old and new numbered
/
lines
from line 62
6262 
6363You can extend each layer by [adding your own rules](#add-your-own-rules). Built-in checks cannot be removed individually, but you can [disable each layer](#disable-or-uninstall) independently.
6464 
65### On each file edit
65<span id="on-each-file-edit" />
6666 
67### Checks on each file edit
68 
6769When Claude writes to a file, the plugin scans the new content for known risky patterns. This is a pattern match with no model call, so it adds no usage cost.
6870 
6971Example pattern categories:
from line 79
7779 
7880You can [add your own patterns](#add-custom-per-edit-patterns) to this layer with a `security-patterns.yaml` file.
7981 
80### At the end of each turn
82<span id="at-the-end-of-each-turn" />
8183 
84### Checks at the end of each turn
85 
8286A turn is one round of Claude responding: you send a message, Claude works and replies, and the turn ends. After each turn, the plugin computes a git diff of everything that changed in the working tree during the turn, including changes from Claude's edit tools, Bash commands, and subagents, and sends it to a separate Claude review focused on security. The review runs in the background, so Claude's reply is not delayed. If the review finds issues, Claude is re-prompted with the findings and addresses them as a follow-up.
8387 
8488This catches issues a string match cannot, such as:
from line 95
9195 
9296You see both the finding and Claude's resolution directly in your session. The review covers up to 30 changed files per turn and fires at most three times in a row before yielding back to you.
9397 
94### On each commit or push Claude makes
98<span id="on-each-commit-or-push-claude-makes" />
99 
100### Checks on each commit or push Claude makes
95101 
96102When Claude runs `git commit` or `git push` through its Bash tool, the plugin runs a deeper agentic review of the change in the background. This review reads surrounding code, including callers, sanitizers, and related files, to decide whether a finding is real before reporting it. The extra context keeps false positives low on patterns that look dangerous in isolation but are safe in your codebase.
97103 
Feedback