A GitHub Action that automatically reviews every pull request for security vulnerabilities using Claude. Posts a detailed comment with findings, severity ratings, and remediation advice — in under 60 seconds.
Add one workflow file to your repository. No servers, no webhooks, no infrastructure. The action runs inside GitHub Actions on every pull request.
Step 1 — Add your Anthropic API key
ANTHROPIC_API_KEY with your key from console.anthropic.com.Step 2 — Create the workflow file
Save this as .github/workflows/security-review.yml:
name: Security Review
on:
pull_request:
types: [opened, synchronize, reopened]
permissions:
pull-requests: write
contents: read
jobs:
security-review:
runs-on: ubuntu-latest
steps:
- uses: eightlabs08/github-pr-security-reviewer@v1
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
github_token: ${{ secrets.GITHUB_TOKEN }}That is everything. Open a pull request and the action posts a security review comment automatically. The GITHUB_TOKEN is provided by GitHub Actions — you do not need to create it.
A two-stage Claude pipeline keeps latency under 60 seconds and cost under $0.10 per PR, even on large diffs.
The Sonnet review prompt is focused on the OWASP Top 10 and common API/backend patterns. It looks at what changed in the diff, not just static signatures.
The action posts a comment directly on the PR. Each finding includes severity, the exact file and line, a description of the vulnerability, and a concrete remediation step.
The query on line 47 concatenates req.query.id directly into a SQL string: `SELECT * FROM users WHERE id = ${req.query.id}`. An attacker can terminate the query and append arbitrary SQL to dump, modify, or delete data.
JWT_SECRET falls back to the hardcoded string `"dev-secret-do-not-use"` when the environment variable is missing. If this code reaches production, all tokens are signed with a known key.
The /auth/reset-password endpoint has no rate limiting. An attacker can enumerate valid email addresses or flood the endpoint to prevent legitimate resets.
[security-review] event=opened pr=42 outcome=skipped reason=not_security_relevant [security-review] triage=negative confidence=high
All options are set via the with: block in your workflow file. Only the two keys below are required — everything else has sensible defaults.
anthropic_api_keyrequiredgithub_tokenrequiredseverity_thresholdoptionaldefault: MEDIUMfail_on_findingsoptionaldefault: falsemax_diff_sizeoptionaldefault: 200000Advanced — block merges on HIGH+ findings
- uses: eightlabs08/github-pr-security-reviewer@v1
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
github_token: ${{ secrets.GITHUB_TOKEN }}
severity_threshold: HIGH # only report HIGH and CRITICAL
fail_on_findings: true # block merge when findings exist
max_diff_size: 100000 # ~100 KB diff limitThe two-stage design keeps costs low. Most PRs are triaged as non-security-relevant by Haiku and never reach the more expensive Sonnet model.
Eight Labs · TheAIHow
The action is open source, MIT licensed, and requires zero infrastructure. Star the repo and drop a workflow file — that is the entire setup.