I pointed my AI security plugin at my own prod app – it refused to invent a bug

kenjitubera1 pts0 comments

GitHub - kenjichristopherv-del/securitymaxxing: Evidence-based application security for Claude Code — audit commands that prove their findings, plus skills that make Claude write secure code by default. · GitHub

/" data-turbo-transient="true" />

Skip to content

Type / to search

Sign in<br>Sign upAppearance settings

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

kenjichristopherv-del

securitymaxxing

Public

Notifications<br>You must be signed in to change notification settings

Fork

Star

main

BranchesTags

Go to file

CodeOpen more actions menu

Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit

History<br>3 Commits<br>3 Commits

.claude-plugin

.claude-plugin

commands

commands

skills

skills

.gitignore

.gitignore

LICENSE

LICENSE

PROMPTS.md

PROMPTS.md

README.md

README.md

SECURITY.md

SECURITY.md

View all files

Repository files navigation

securitymaxxing

Application security for Claude Code. Audit commands that prove their findings, plus skills<br>that make Claude write secure code before you ask.

Built for two people: the engineer who knows what an IDOR is and wants a rigorous second pair<br>of eyes, and the builder who shipped something with AI help and needs a straight answer to<br>"is this safe to put on the internet?"

Why this exists

Ask any AI to "check my code for security issues" and you get a page of confident, plausible,<br>mostly-wrong findings. Missing headers on a JSON API. SQL injection in a parameterized query.<br>A CVE number that doesn't exist. You read it twice, find nothing real, and never run it again —<br>so the one endpoint that does leak your customers' addresses ships anyway.

The problem isn't the model. It's the prompt.

securitymaxxing encodes the discipline a real security engineer applies:

No finding without a traced path from an attacker-controlled source to a dangerous sink.<br>Both ends named, or it's flagged "needs verification" instead of reported as fact.

Check the mitigation first. Most "SQL injection in an ORM" findings die once you read<br>what the framework actually does in that version.

Severity by realistic exploitability × impact , not by how frightening the bug class sounds.

Zero findings is a valid result. No padding a report to look thorough.

Every finding carries the exploit path and the patch — the requests an attacker sends,<br>and the corrected code.

Install

/plugin marketplace add kenjichristopherv-del/securitymaxxing<br>/plugin install securitymaxxing

Or, for local development:

/plugin marketplace add ~/Developer/securitymaxxing<br>/plugin install securitymaxxing

The commands

Type /sec in Claude Code and they'll all filter into view.

Command<br>What it does

/securitymaxxing:audit<br>Full audit — maps the attack surface first, then works every vulnerability class with traced evidence

/securitymaxxing:diff<br>Reviews a diff, branch, or PR. Catches the removed guard clause and the route registered on the wrong router

/securitymaxxing:vibe-check<br>Plain-English safety check. No jargon, real rigor, direct verdict

/securitymaxxing:ship-check<br>Pre-launch gate. Ten blockers, then should-fixes, then a SHIP / DO NOT SHIP verdict

/securitymaxxing:threat-model<br>STRIDE model with a Mermaid data-flow diagram and trust boundaries

/securitymaxxing:authz<br>Broken access control — IDOR, mass assignment, tenant isolation. The highest-yield review

/securitymaxxing:authn<br>Auth, sessions, JWTs, password reset, OAuth account-linking takeover

/securitymaxxing:injection<br>Source-to-sink tracing: SQL, command, XSS, SSRF, path traversal, deserialization, SSTI

/securitymaxxing:secrets<br>Sweeps the working tree and git history . Outputs a rotation list, not a cleanup list

/securitymaxxing:api<br>CORS, CSRF, headers, rate limits, over-fetching, GraphQL, file uploads

/securitymaxxing:crypto<br>Algorithms, IV reuse, key management, TLS verification, what shouldn't be stored at all

/securitymaxxing:deps<br>Runs the real auditor, then triages — which of the 140 alerts are actually reachable

/securitymaxxing:harden<br>Docker, Kubernetes, Terraform, cloud IAM, and detection readiness

/securitymaxxing:llm<br>Prompt injection, tool authority, RAG tenant isolation, unsafe model output

/securitymaxxing:redteam<br>Proves it. Builds a working PoC against your own app, and attacks your defenses to confirm they hold

/securitymaxxing:fix<br>The only command that writes code. Fixes the class, verifies the patch, adds the regression test

/securitymaxxing:explain<br>Explains a vulnerability against your code, so you can spot it yourself next time

Every command is read-only except fix (which writes patches) and redteam (which sends<br>active attacks against an app you own).

The skills

Skills load automatically when Claude detects the relevant work — no command needed.

Skill<br>Triggers...

securitymaxxing code claude security plugin skills

Related Articles