# Review all unstaged changes
claude -p "Review my changes for bugs, security issues, and improvements" < <(git diff)
 
# Review staged changes only
claude -p "Review these staged changes" < <(git diff --cached)
 
# Review changes since last commit
claude -p "Review all changes since the last commit" < <(git diff HEAD~1)

# Deep review of a single file
claude -p "Do a thorough code review of this file. Check for:
1. Bugs and logic errors
2. Security vulnerabilities
3. Performance issues
4. Missing error handling
5. Test coverage suggestions" < src/services/payment.ts

# Review multiple related files together
claude -p "Review these files as a cohesive unit. Check for:
- Consistency between the service, controller, and model
- Missing validation at boundaries
- Error propagation patterns
$(cat src/controllers/order.ts src/services/order.ts src/models/order.ts)"

# Get the full diff of a PR branch vs main
git diff main...feature/payment-refactor | claude -p "Review this PR diff. Focus on:
1. Breaking changes to public APIs
2. Database migration safety
3. Backward compatibility
4. Missing tests for new code paths"

# Start interactive session in your project
cd your-project
claude
 
# Then ask for reviews
> Review the authentication module for security vulnerabilities
> Check src/middleware/auth.ts for OWASP Top 10 issues
> Compare our error handling pattern in services/ — is it consistent?
> Find all places where user input isn't sanitized

# .github/workflows/claude-review.yml
name: Claude Code Review
 
on:
  pull_request:
    types: [opened, synchronize, reopened]
 
permissions:
  contents: read
  pull-requests: write
 
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
 
      - name: Get PR diff
        id: diff
        run: |
          git diff origin/${{ github.base_ref }}...HEAD > pr_diff.txt
 
      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code
 
      - name: Run Claude Code Review
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          claude -p "You are a senior code reviewer. Review this pull request diff.
 
          PR Title: ${{ github.event.pull_request.title }}
          PR Description: ${{ github.event.pull_request.body }}
 
          Provide your review in this format:
          ## Summary
          Brief overview of what this PR does.
 
          ## Issues Found
          ### 🔴 Critical (must fix before merge)
          ### 🟡 Warnings (should fix)
          ### 🔵 Suggestions (nice to have)
 
          ## Security Check
          List any security concerns.
 
          ## Test Coverage
          What tests are missing?
 
          Be specific. Reference file names and line numbers.
          If the code looks good, say so — don't invent problems." \
          < pr_diff.txt > review_output.md
 
      - name: Post Review Comment
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const review = fs.readFileSync('review_output.md', 'utf8');
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `## 🤖 Claude Code Review\n\n${review}`
            });

# .gitlab-ci.yml
claude-review:
  stage: review
  image: node:20
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  script:
    - npm install -g @anthropic-ai/claude-code
    - git diff origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME...HEAD > mr_diff.txt
    - |
      claude -p "Review this merge request diff.
      MR Title: $CI_MERGE_REQUEST_TITLE
 
      Format: Summary, Critical Issues, Warnings, Suggestions, Security, Tests.
      Be specific with file names and line numbers." \
      < mr_diff.txt > review.md
    - |
      # Post as MR note
      REVIEW=$(cat review.md)
      curl --request POST \
        --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
        "$CI_API_V4_URL/projects/$CI_PROJECT_ID/merge_requests/$CI_MERGE_REQUEST_IID/notes" \
        --data-urlencode "body=## 🤖 Claude Code Review
 
      $REVIEW"
  variables:
    ANTHROPIC_API_KEY: $ANTHROPIC_API_KEY

# bitbucket-pipelines.yml
pipelines:
  pull-requests:
    '**':
      - step:
          name: Claude Code Review
          image: node:20
          script:
            - npm install -g @anthropic-ai/claude-code
            - git diff origin/$BITBUCKET_PR_DESTINATION_BRANCH...HEAD > diff.txt
            - claude -p "Review this PR diff for bugs, security issues, and improvements." < diff.txt > review.md
            - pipe: atlassian/bitbucket-pr-comment:1.0.0
              variables:
                COMMENT_FILE: review.md

claude -p "Perform a security audit of this codebase. Check for:
 
OWASP Top 10 (2026):
1. Broken Access Control — check every endpoint for auth/authz
2. Cryptographic Failures — weak hashing, plaintext secrets, bad TLS config
3. Injection — SQL, NoSQL, OS command, LDAP, XPath
4. Insecure Design — missing rate limits, no account lockout
5. Security Misconfiguration — default creds, verbose errors in prod
6. Vulnerable Components — check package.json/requirements.txt
7. Auth Failures — session management, token handling, password policy
8. Data Integrity — unsigned JWTs, insecure deserialization
9. Logging Gaps — missing audit logs for sensitive operations
10. SSRF — server-side request forgery in URL handling
 
Also check for:
- Hardcoded API keys, tokens, or passwords
- Missing CORS configuration or overly permissive CORS
- Insecure file upload handling
- Missing Content Security Policy headers
- Debug endpoints left in production code
 
Output format: severity (CRITICAL/HIGH/MEDIUM/LOW), file, line, description, fix."

# Pipe your lockfile for dependency analysis
claude -p "Analyze these dependencies for known security concerns.
Flag any packages that are:
1. Unmaintained (no updates in 12+ months)
2. Known to have vulnerabilities
3. Doing more than needed (bloated for the use case)
4. Better replaced with maintained alternatives" < package-lock.json

# Scan entire repo for secrets
claude -p "Scan this codebase for hardcoded secrets, API keys, tokens, passwords, or credentials. Check:
- Source code files
- Configuration files
- Environment file templates
- Docker files
- CI/CD configs
- Comments and TODOs
 
For each finding, report: file, line, type of secret, risk level." \
< <(find . -type f -name '*.ts' -o -name '*.js' -o -name '*.py' -o -name '*.env*' -o -name '*.yml' -o -name '*.yaml' -o -name 'Dockerfile*' | xargs cat)

# Review database migrations for safety
claude -p "Review these database migrations for production safety:
 
Check for:
1. Destructive operations (DROP TABLE, DROP COLUMN) without backup plan
2. Long-running operations that will lock tables (ALTER TABLE on large tables)
3. Missing indexes for new foreign keys
4. Data type changes that could cause data loss
5. Missing rollback/down migrations
6. Default values that could cause issues at scale
7. NOT NULL constraints added without default (will fail on existing rows)
 
For each issue, suggest the safe alternative." \
< <(find migrations/ -name '*.sql' -newer migrations/last_reviewed | cat)

# CLAUDE.md
 
## Project Context
This is a Next.js 15 + Supabase application.
- TypeScript strict mode
- Server components by default, 'use client' only when needed
- Supabase Row Level Security (RLS) for all tables
- Zod for all input validation
 
## Code Review Standards
When reviewing code in this project:
1. All database queries must go through the service layer, never direct from routes
2. Every API endpoint must validate input with Zod schemas
3. All user-facing errors must be generic (no stack traces, no internal IDs)
4. New features require unit tests (Vitest) and at least one integration test
5. Environment variables must be accessed through src/config.ts, never process.env directly
6. All money amounts stored as integers (cents), never floats
 
## Known Technical Debt
- Legacy auth in src/lib/auth-old.ts — do not extend, will be replaced
- Some API routes still use Pages Router — migration in progress
- Redis caching layer is planned but not implemented yet
 
## Architecture Patterns
- Repository pattern for database access
- Service layer for business logic
- Controller layer only handles HTTP concerns
- Middleware for cross-cutting concerns (auth, logging, rate limiting)

# In your CI config
- name: Check for critical issues
  run: |
    if grep -q "🔴 Critical" review_output.md; then
      echo "Critical issues found — blocking merge"
      exit 1
    fi

claude -p "Review this React code for:
- useEffect dependency array completeness
- Missing cleanup in useEffect
- Unnecessary re-renders (missing memo/useMemo/useCallback)
- Server vs client component boundary issues
- Missing Suspense boundaries for async components
- Proper error boundary coverage"

claude -p "Review this Laravel code for:
- Mass assignment vulnerabilities (missing \$fillable/\$guarded)
- N+1 queries (missing eager loading)
- Missing form request validation
- Raw queries without parameter binding
- Missing middleware on routes
- Queue job idempotency"

claude -p "Review this FastAPI code for:
- Missing Pydantic model validation
- Async/sync mixing issues
- Missing dependency injection
- Unhandled exceptions in background tasks
- Missing rate limiting on public endpoints
- SQL injection in SQLAlchemy raw queries"

claude -p "Review for e-commerce concerns:
- Race conditions in inventory management
- Price calculation precision (floating point)
- Payment flow atomicity
- PCI DSS compliance issues
- Order state machine correctness"

claude -p "Review for compliance:
- PII/PHI data handling and encryption
- Audit logging completeness
- Data retention policy compliance
- Access control granularity
- Regulatory data residency requirements"