Claude Code

Using Claude Code to fix security findings safely

AI coding agents are strongest when the finding is specific, the desired behaviour is clear, and you ask for verification instead of blind edits.

1 August 2026 · 5 min read

Claude Code can fix most production hygiene issues quickly, but the prompt decides whether you get a precise patch or a broad rewrite. The difference is not prompt-engineering trickery. It is whether the agent has been told what is true, what must not change, and how the work will be checked.

Name the finding, not the feeling

A vague instruction like make this secure invites the agent to guess at a threat model and refactor accordingly. A better prompt names the finding, the affected URL, the observed evidence, and the constraint that existing behaviour must remain intact.

For example: Our scan says the Content Security Policy is missing on https://example.com. Find where response headers are set, add a conservative CSP for this app, and run the existing build and lint checks. Do not add third-party scripts. That gives the agent a target and a boundary.

Ask for verification, not confidence

Security fixes touch deployment surfaces: middleware, proxy files, headers, cookies, framework config. These are exactly the places where a change looks correct in a diff and behaves differently in production.

So require the agent to say what changed and which checks ran. If a change cannot be verified locally — a header that only the host applies, say — that should be stated rather than assumed. An agent that reports what it could not confirm is more useful than one that reports success.

Keep the diffs small

One finding per prompt produces safer changes than a single sweeping security cleanup. It also produces a review you can actually read, which matters when the change is going straight to production.

Treat Claude Code as a fast pair programmer, not a certification authority. It can make the patch. You still own the deploy, the review, and the judgement about whether a stricter policy might break a real user flow.

Common questions

Can Claude Code fix security issues on its own?

It can produce the patch reliably when the finding is specific and the constraints are stated. What it cannot do is decide whether the fix is acceptable for your users — a stricter policy that breaks a checkout flow is a worse outcome than the original finding.

What makes a good security fix prompt?

The finding, the URL, the evidence, the constraint that existing behaviour must be preserved, and a request to run the project's own checks afterwards. Scan reports that generate this for you remove the guesswork.

Should I let an agent change production config?

Let it propose the change and read the diff yourself. Header, proxy and middleware changes affect every route at once, which is a large blast radius for an unreviewed edit.