Finding and Fixing Vulnerabilities with Claude

What's inside

1. Level 1: Ground Rules: Independence, Permission, Defence OnlyFree
   Learn that this course is independent of Anthropic, that every tool in it is beta or preview and must be checked against the current documentation, and that you scan only code you are authorised to scan, then set up the deliberately vulnerable practice repository.
2. Level 2: Reasoning Reviewer vs Pattern Scanner, and the LimitsFree
   See how a reviewer that reasons over data flow across files differs from a rule-based scanner, and why its results vary between runs, include false positives and misses, and never replace tests or human sign-off.
3. Level 3: The Layer Map and a First Scan
   Map the six layers (security guidance while coding, /security-review on a branch, the Claude Security plugin's deep scan, Code Review on pull requests, your CI scanners, the managed service) to the moments they fit, and run a first quick security pass on the practice repository.
4. Level 4: Security Guidance While Claude Writes Code
   Install the security-guidance plugin and watch its three checkpoints work (a model-free pattern match on each edit, a background review at the end of each turn, and a deeper review when Claude commits or pushes), then add your own project rules.
5. Level 5: /security-review on a Branch
   Run the built-in /security-review command as a one-time pass over the changes on your current branch, and learn what it does and does not cover compared with a scan of existing code.
6. Level 6: Installing the Claude Security Plugin (Beta)
   Install the beta claude-security plugin from the official marketplace, confirm its requirements (a plan or provider that supports dynamic workflows, Python 3.9 or later as python3, git for change scans and patches), and understand which model your scan will run on.
7. Level 7: Scoping a Deep Scan: Coverage, Cost and Time
   Run the plugin's Scan codebase job with a deliberate scope, weighing the file count and relative cost it shows before you confirm, and understand how its agents map the code, build a threat model, hunt and independently verify.
8. Level 8: Inside the Output Folder
   Find your way around the timestamped CLAUDE-SECURITY results directory: the Markdown report, the JSON lines file, the SARIF log, the revision stamp and the patches folder, and decide whether a report belongs in git history.
9. Level 9: Reading a Finding Field by Field
   Take one finding apart: its ID, category and CWE, severity judged by exploitability, confidence, location, impact, exploit scenario or reproduction steps, and recommended fix, and learn what each field should and should not make you conclude.
10. Level 10: Verifying a Finding Before You Act
    Confirm or refute a finding yourself by tracing input to sink in the code and writing a minimal, harmless reproduction as a failing test in a local environment only.
11. Level 11: Triage: Fix, Accept or Dismiss, With a Reason
    Turn verified findings into recorded decisions (fix, accept the risk, or dismiss), each with a reason, an owner and a date, kept in a triage log tied to the revision stamp so that the next nondeterministic scan does not reopen settled questions.
12. Level 12: Patches Are Never Applied for You
    Use the Suggest patches job, read the per-finding patch file and its note, apply it yourself with git apply on a dedicated branch, run the tests, and send it through normal review as its own pull request.
13. Level 13: SARIF Into Code Scanning and Trackers
    Move findings out of the results folder and into the tools your team already works in, by uploading the SARIF 2.1.0 log to a code-scanning tool and turning JSON lines records into tracker tickets without leaking sensitive detail.
14. Level 14: Scanning Changes: Pre-PR, Code Review and CI
    Scan only a branch diff, an open pull request or a single commit with the plugin before review, then place that alongside Code Review on pull requests and the deterministic scanners in CI, being honest about what is not documented for headless use.
15. Level 15: The Managed Service: Prerequisites and Setup
    Assess the managed Claude Security public beta for Enterprise: who enables it, connecting GitHub.com or GitHub Enterprise Server repositories, how projects organise scans, and what it reaches that the local plugin does not, and the reverse.
16. Level 16: Operating the Managed Service: Scans, Exports, Billing
    Run the managed service day to day with scheduled and directory- or branch-scoped scans, finding statuses and dismissals with reasons, CSV and Markdown export, per-project webhooks to tools such as Slack or Jira, billing by token cost, and the absence of zero data retention.
17. Level 17: A Team Routine: Cadence, Ownership, Time to Fix
    Turn the tools into a routine by setting which layer runs when, who owns triage and each fix, time-to-fix targets by severity, and how findings are handled as sensitive material until they are fixed.
18. Level 18: Final Challenge: Scan to Triage to Tested Patch Exam
    Prove the whole workflow on the practice repository: confirm authorisation, pick layers, scope and run a scan, read and verify findings, record triage decisions, take one patch through branch, tests and review, export SARIF, and state what remains unconfirmed.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →