Skip to content
Book a callSkip the hiring grind

Day 45 of 52 · about 20 min · Safety · Bonus

Review changes for bugs and security before you ship

Whoever wrote the change, you or Claude, has stopped seeing it. A second pass that only hunts for bugs and security holes catches what the author missed, and it costs one command before you push.

You’ll finish with

  • A bug review of your current changes with /code-review
  • A security pass over your branch with /security-review
  • A clear rule for when a deeper review is worth it

You’ll need

  • A git repository with an origin remote, and a branch with at least one change on it
  • Claude Code open in that repository
  • Only for the deeper options: ultrareview is a research preview and needs a claude.ai login (/login), and the Code Review service needs a Team or Enterprise plan
Start from the practice project as of Day 35 (.zip, 46 KB)

Before you start

Tell us about your setup and the steps change to fit it. Your answers stay in this browser, and you can change them at any time.

Which system are you on?

Commands differ between systems. Pick the one you’ll run Claude Code on.

The steps

One step at a time. When a step’s check matches, tick it and the next one opens.

0 of 3 steps done0%

  1. Step 1 of 3: Review your diff with /code-review

    It reviews your branch and uncommitted changes for bugs, in the background.

    It reads your branch’s commits ahead of its upstream plus any uncommitted changes, and reports correctness bugs. It follows your CLAUDE.md like any session.

    In Claude Code

    You type: /code-review

    What happens: The review runs as a background subagent with its own context window, so you can keep working.

    Add --fix to apply the findings, or pass a path, branch or PR number to review that instead.

    Check it worked

    The findings arrive in your conversation when the review completes.

  2. Step 2 of 3: Check the branch with /security-review

    Run a one-time security pass over the changes on your branch.

    It compares your branch with the default branch on origin and looks for risks like injection, auth issues and data exposure. It covers only your changes, not the whole repository.

    In Claude Code

    You type: /security-review

    What happens: Claude reads the diff against origin/HEAD and reports the risks it finds.

    It reads the code in your checkout, not a running site.

    Check it worked

    Claude replies with a security review of the files your branch changed.

    If it didn’t work

    It fails with an ambiguous argument error

    Your clone has no origin/HEAD. Create it, then run /security-review again:

    Terminal
    git fetch origin
git remote set-head origin --auto

  3. Step 3 of 3: Know when to go deeper

    Choose between the local review, ultrareview and the Code Review service.

    Run the local review on every change. Go deeper when a change is large or risky.

    /code-review

    • Runs in your session
    • Reports correctness bugs; --fix applies them

    /code-review ultra

    • Research preview, in a cloud sandbox
    • Each finding independently reproduced
    • Pro and Max: 3 free runs, then usage credits

    Code Review service

    • Team and Enterprise, on GitHub
    • Reviews GitHub pull requests with inline comments
    Ultrareview shows the estimated cost before it starts.

    Check it worked

    If you try /code-review ultra, a dialog shows the scope, your free runs left and the estimated cost before anything runs.

Finish · 3 of 3 steps to go

Every change gets a second pass

Make /code-review and /security-review the last thing you run before you push, and save the deeper reviews for changes that deserve them.

What you’ll have checked

  • /code-review reported on your diff
  • /security-review reported on your branch

Lesson updates by email

Get lesson updates by email

Leave your email and we’ll tell you when we add or update a lesson.

We’ll email you when we add or update a lesson. We use your email only for this. Privacy policy

Claude Code for your team

Want Claude Code set up across your team?

HorizonLux sets up and repairs Claude Code for teams: CLAUDE.md rules, hooks that enforce them and reviewed MCP servers. Book a free call to talk it through.

Book a free call Claude Code agency

Related

How we build

AI software factory

Questions

Questions about Day 45

Does /code-review read REVIEW.md?

No. It follows your CLAUDE.md like any session. REVIEW.md tunes the Code Review service on GitHub.

Sources

Checked against the official Claude Code docs on .

Independent resource, not affiliated with Anthropic. HorizonLux wrote this lesson; Claude Code is made by Anthropic.