Security scanner.

The security scanner is a built-in Claude Code command that reads through your codebase looking for vulnerabilities, the kind of holes that let someone break in, leak data, or run code they shouldn't.

You run it with /security-review from inside your project, and it goes through your code and flags what it finds. No setup, no separate tool.

When it launched, it found over 500 real bugs that human experts had missed. If you're Vibe coding, building stuff by describing it to AI without a deep coding background, this is the safety net you want, because you can't always eyeball whether what got built is actually safe. Run it before you put anything live.