{"version":"2.1.318","anchor":"security-intent-scoring-of-user-prompts-added-with-a-caller","canonical_anchor":"security-intent-scoring-of-user-prompts-added-with-a-caller","heading":"Prompts are scored for security-related intent","tier":"notice","area":"Code Review","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318\/e\/security-intent-scoring-of-user-prompts-added-with-a-caller","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318","markdown":"### Prompts are scored for security-related intent\n\nClaude Code now scores each prompt 0 to 2 for security-audit intent and stores it in _securityCheckRequestScores; hook docs mention inner REPL calls\n\n**Unclear.** It is not known where the stored scores are used, or whether they are sent anywhere.\n\n**What**\n\nClaude Code now scores each prompt you type for how strongly it asks for security work, and keeps those scores for the session.\n\n- A score of 2 means audit or vulnerability-hunting wording such as 'security audit' or 'find vulnerabilities'.\n\n- A score of 1 means any mention of 'security', or words starting with 'vuln' or 'exploit'.\n\n- Phrases like 'social security' and 'dependency injection' do not count.\n\n- Only nonzero scores are kept, in a `_securityCheckRequestScores` map keyed by each message's id. These sit with the signals Claude Code uses to choose tips.\n\n- Scoring is skipped when one of the other checks that sort prompts into kinds has already matched.\n\nSeparately, the description of the `classifierContext` hook field changed. A hook is a script you set up to run at certain moments. Behind an internal check, the description now says that inner REPL calls, as well as remote-engine shells, produce no per-result line. Before, it named only remote-engine shells.\n\n**Why**\n\nYour prompts are now sorted by whether they look like a security request. The members do not show where the scores are used. Their placement next to tip signals points to a security-related tip. If you write hooks that read `classifierContext`, note that inner REPL calls also leave no per-result line there.\n\n- Area: Code Review\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 4\/5\n- Scope: individual\n- Heads-up: no"}