security-scanner — Claude Code hook: scan code after every edit
This hook runs a security pass whenever Claude edits or writes a file. It looks for vulnerabilities and hardcoded secrets.
npx claude-code-templates@latest --hook security/security-scannerWhat security-scanner does
The hook listens on PostToolUse for Edit and Write. Once a file changes, three tools get a shot at it: semgrep with --config=auto, bandit for .py files, and gitleaks detect --no-git. A plain grep check runs too, looking for lines like password=, secret=, key= or token= with a value of eight characters or more. A hit prints a warning with the file path to stderr.
Every tool is wrapped in command -v, so it only fires if it is already installed. No semgrep on the machine means that step is skipped silently. Check your scanners before wiring this up — otherwise the hook runs, reports nothing, and you take that as a clean bill of health.
Each call ends with || true, so the hook never blocks Claude or halts the session on a finding. Treat it as a background check rather than a hard gate: you see the output, you decide what to do.
What it helps with
- catch a hardcoded token right after the agent writes it into a file
- run bandit on a changed Python file without invoking it by hand
- scan a fresh edit for common vulnerability patterns with semgrep
- find secrets in a file that has not been committed to git yet
Example prompts for the agent
- update the config in
config.pyand check nothing leaked a key - add webhook handling to
server.py - move the connection string out of
db.pyinto environment variables
How to install security-scanner
1claude-code-templates
npx claude-code-templates@latest --hook security/security-scanner2Manually: put the files in place
.claude/settings.jsonThe hooks block: event (PreToolUse, PostToolUse, Stop…) → command. Personal ones go to ~/.claude/settings.json
Step by step, with commands for each platform: Claude Code hooks: what they are, where to configure them, how to block a risky command
Questions about security-scanner
How do I install security-scanner in Claude?
Run npx claude-code-templates@latest --hook security/security-scanner, then check the entry in .claude/settings.json.
What does security-scanner do?
After each edit or write it runs semgrep, bandit for Python files and gitleaks, plus a text check for lines containing passwords, secrets, keys or tokens.
What do I need for the hook to work?
The scanners have to be installed: the hook calls each one only if it is in PATH. If semgrep, bandit or gitleaks is missing, that step is skipped.
Source text
security-scanner.json · MIT
{
"description": "Scan code for security vulnerabilities and secrets after modifications. Uses multiple security tools to detect potential issues.",
"hooks": {
"PostToolUse": [
{
"matcher": "Edit|Write",
"hooks": [
{
"type": "command",
"command": "if command -v semgrep >/dev/null 2>&1; then semgrep --config=auto \"$CLAUDE_TOOL_FILE_PATH\" 2>/dev/null || true; fi; if command -v bandit >/dev/null 2>&1 && [[ \"$CLAUDE_TOOL_FILE_PATH\" == *.py ]]; then bandit \"$CLAUDE_TOOL_FILE_PATH\" 2>/dev/null || true; fi; if command -v gitleaks >/dev/null 2>&1; then gitleaks detect --source=\"$CLAUDE_TOOL_FILE_PATH\" --no-git 2>/dev/null || true; fi; if grep -qE '(password|secret|key|token)\\s*=\\s*[\"\\x27][^\"\\x27]{8,}' \"$CLAUDE_TOOL_FILE_PATH\" 2>/dev/null; then echo \"Warning: Potential hardcoded secrets detected in $CLAUDE_TOOL_FILE_PATH\" >&2; fi"
}
]
}
]
}
}
© davila7 · MIT · davila7/claude-code-templates
