GitHub - kenjichristopherv-del/securitymaxxing: Evidence-based application security for Claude Code — audit commands that prove their findings, plus skills that make Claude write secure code by default. · GitHub
/" data-turbo-transient="true" />
Skip to content
Type / to search
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
kenjichristopherv-del
securitymaxxing
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>3 Commits<br>3 Commits
.claude-plugin
.claude-plugin
commands
commands
skills
skills
.gitignore
.gitignore
LICENSE
LICENSE
PROMPTS.md
PROMPTS.md
README.md
README.md
SECURITY.md
SECURITY.md
View all files
Repository files navigation
securitymaxxing
Application security for Claude Code. Audit commands that prove their findings, plus skills<br>that make Claude write secure code before you ask.
Built for two people: the engineer who knows what an IDOR is and wants a rigorous second pair<br>of eyes, and the builder who shipped something with AI help and needs a straight answer to<br>"is this safe to put on the internet?"
Why this exists
Ask any AI to "check my code for security issues" and you get a page of confident, plausible,<br>mostly-wrong findings. Missing headers on a JSON API. SQL injection in a parameterized query.<br>A CVE number that doesn't exist. You read it twice, find nothing real, and never run it again —<br>so the one endpoint that does leak your customers' addresses ships anyway.
The problem isn't the model. It's the prompt.
securitymaxxing encodes the discipline a real security engineer applies:
No finding without a traced path from an attacker-controlled source to a dangerous sink.<br>Both ends named, or it's flagged "needs verification" instead of reported as fact.
Check the mitigation first. Most "SQL injection in an ORM" findings die once you read<br>what the framework actually does in that version.
Severity by realistic exploitability × impact , not by how frightening the bug class sounds.
Zero findings is a valid result. No padding a report to look thorough.
Every finding carries the exploit path and the patch — the requests an attacker sends,<br>and the corrected code.
Install
/plugin marketplace add kenjichristopherv-del/securitymaxxing<br>/plugin install securitymaxxing
Or, for local development:
/plugin marketplace add ~/Developer/securitymaxxing<br>/plugin install securitymaxxing
The commands
Type /sec in Claude Code and they'll all filter into view.
Command<br>What it does
/securitymaxxing:audit<br>Full audit — maps the attack surface first, then works every vulnerability class with traced evidence
/securitymaxxing:diff<br>Reviews a diff, branch, or PR. Catches the removed guard clause and the route registered on the wrong router
/securitymaxxing:vibe-check<br>Plain-English safety check. No jargon, real rigor, direct verdict
/securitymaxxing:ship-check<br>Pre-launch gate. Ten blockers, then should-fixes, then a SHIP / DO NOT SHIP verdict
/securitymaxxing:threat-model<br>STRIDE model with a Mermaid data-flow diagram and trust boundaries
/securitymaxxing:authz<br>Broken access control — IDOR, mass assignment, tenant isolation. The highest-yield review
/securitymaxxing:authn<br>Auth, sessions, JWTs, password reset, OAuth account-linking takeover
/securitymaxxing:injection<br>Source-to-sink tracing: SQL, command, XSS, SSRF, path traversal, deserialization, SSTI
/securitymaxxing:secrets<br>Sweeps the working tree and git history . Outputs a rotation list, not a cleanup list
/securitymaxxing:api<br>CORS, CSRF, headers, rate limits, over-fetching, GraphQL, file uploads
/securitymaxxing:crypto<br>Algorithms, IV reuse, key management, TLS verification, what shouldn't be stored at all
/securitymaxxing:deps<br>Runs the real auditor, then triages — which of the 140 alerts are actually reachable
/securitymaxxing:harden<br>Docker, Kubernetes, Terraform, cloud IAM, and detection readiness
/securitymaxxing:llm<br>Prompt injection, tool authority, RAG tenant isolation, unsafe model output
/securitymaxxing:redteam<br>Proves it. Builds a working PoC against your own app, and attacks your defenses to confirm they hold
/securitymaxxing:fix<br>The only command that writes code. Fixes the class, verifies the patch, adds the regression test
/securitymaxxing:explain<br>Explains a vulnerability against your code, so you can spot it yourself next time
Every command is read-only except fix (which writes patches) and redteam (which sends<br>active attacks against an app you own).
The skills
Skills load automatically when Claude detects the relevant work — no command needed.
Skill<br>Triggers...