Claude Code ships with two commands aimed at checking work rather than writing it: /review and /security-review. Both give you a second pair of eyes on changes before they go out.
/review for general quality
Run /review (also spelled /code-review) to have Claude look over your changes for bugs, unclear logic, and things that don't match the rest of the codebase.
/review
It reads the diff and reports what it finds. This is a good habit right before you commit, or when you've inherited code and want a read on its shape. Because Claude already knows your project through CLAUDE.md and the files it has seen, the feedback tends to fit your conventions rather than generic advice.
/security-review for risk
When your changes touch anything sensitive — auth, user input, database queries, file handling — run a focused security pass:
/security-review
This looks specifically for security problems: injection risks, leaked secrets, missing input checks, and similar. It's narrower than a general review and worth running whenever a change could expose data or accept outside input.
Fitting them into your flow
Think of these as the verify step in an explore, plan, build, verify loop. Write the code, run /review to catch quality issues, and run /security-review on anything risky before you commit. Neither replaces human judgment or your test suite, but both catch a surprising amount early, when fixes are cheap. Make them part of your pre-commit routine and fewer problems reach your reviewers.
Comments
Be the first to comment.