Claude Code Security Review and Code Quality — Claude Opus Wrote It, We Scanned It

This guide uses a synthetic ShipDesk shipment and waybill desk written for the walkthrough only. It is not a real product and was never deployed. Everything under src/ came from one prompt sent to Claude Opus in Cursor; nothing was edited by hand before the baseline scan.

The prompt asked for a small logistics desk — staff login, searchable shipment lists, CSV waybill reports that can be zipped and emailed, waybill scan upload and download, a column layout import from an old desktop tool, and admin endpoints for warehouse sync and server stats. It deliberately did not ask for security hardening, tests, or Docker.

The result ran correctly. That is the point worth holding onto before the scan: working and reviewed are different properties, and a Claude Code security review exists to test the second one.

Save the prompt text alongside the archive you upload so later readers can see what the model was asked to produce.

Request a token with the account credentials and a name you will recognise later. Send the access token as a bearer credential on every subsequent request.

If token creation returns SESSION_LIMIT_REACHED, revoke unused tokens or clear active JWT sessions on the installation before retrying. Tokens on the captured installation expire after fifteen minutes of inactivity, so reissue before a long session.

Start the scan with languages=JAVASCRIPT and cqLanguages=JAVASCRIPT so DerScanner analyses security rules and code-quality rules in the same pass. Passing a name on the first scan creates the project; reuse the returned project UUID for the rescan so both scans sit side by side.

Keep AI triage flags off for every severity. The scan analyses the code and leaves every finding unverified until you choose otherwise.

The scan finished in about a second on this sample and reported 31 security findings — six critical, twenty-four medium, one low — with a security score of 16 across 630 lines. Code Quality on the same scan reported 700 findings with 431 critical and a CQ score of 1.

Poll the project scan list until status is COMPLETE. Each scan DTO carries the security counts (critical, medium, low, info, score, loc) and the quality counts (criticalCq, mediumCq, lowCq, scoreCq, locCq) in one response, so a single call gives you both halves of the review.

A security score of 16 out of 100 is the headline, but the rule families matter more. Eleven fired on the baseline: SQL injection, reflected XSS, weak hashing, plain HTTP usage, hardcoded password, hardcoded crypto key, insecure randomness, three separate cookie rules, and unexpected network activity.

Note that DerScanner does not ship a single report that merges security and quality. Export the fields you need from the API or the Overview page, then assemble the combined view in Cursor Canvas or your own reporting tool.

Open the detailed results for the baseline scan. Fourteen JS_INJECTION_SQL hits dominate the list — every query in the login path, the shipment search, the status counters, the report date range, and the carrier lookup is assembled by string concatenation, and the update helper builds its SET clause by looping over request-body keys.

JS_CRYPTO_BAD_HASH covers MD5 password hashing and SHA-1 request signing. JS_CRYPTO_BAD_RANDOM points at a session token derived from Math.random. JS_CRYPTO_KEY_HARDCODED and two JS_PASSWORD_HARDCODED hits point at the session secret, the admin token, and the carrier API password sitting in source.

JS_HTTP_USAGE and JS_BACKDOOR_NETWORK_ACTIVITY flag carrier tracking calls made over plain HTTP with the API password in a request header. The three cookie rules — JS_COOKIE_NOT_HTTPONLY, JS_COOKIE_NOT_OVER_SSL, JS_COOKIE_BROAD_PATH — all trace to one res.cookie call with no attributes at all.

Three JS_XSS_REFLECTED hits land on the HTML report preview, which interpolates the report title, the date range, and every row of shipment data straight into a template string.

Switch the Overview and Detailed Results pages to the CQ slice. The URLs are the same paths with /cq appended, so /projects/$PROJECT/summary_data/cq and /projects/$PROJECT/detailed_results/cq both take the same scan query parameter.

The baseline CQ score is 1 out of 100 across 700 findings. Read the rule mix before reacting to the number: 211 hits for incorrect use of single quotes and 120 for quote formatting are string conventions, while 89 uses of var, 8 string literals thrown as errors, 2 eval calls, and 1 unguarded for…in loop are genuine hygiene problems.

That split is the useful part of a quality review on AI-generated code. The convention hits tell you the model ignored a house style it was never given; the hygiene hits overlap with security — the two eval calls are the same dynamic-execution sinks a reviewer would flag by hand, reached through the layout import and a legacy filter helper.

The CQ detailed results list every finding with its file and line, so you can group by rule before writing the remediation prompt. Grouping matters here: two rules account for 331 of the 431 critical findings, and fixing them is a formatting decision rather than a code change.

The remaining critical hygiene rules are the ones worth prompting about individually — replace var with const and let, throw Error objects instead of string literals, and remove both eval sinks.

Send a second prompt in Cursor that references the DerScanner results and asks for specific fixes. Keep the security list and the quality list separate so the model does not treat a formatting rule as a security fix.

The remediation prompt is saved as PROMPT-REMEDIATION.txt in the sample archive so the before/after provenance is clear. Re-zip the project after Cursor applies the edits, keeping the same top-level folder name — Scans Comparison matches findings by file path, so a changed archive root makes every finding look fixed and re-added.

Three string literals containing double quotes had to be adjusted by hand afterwards, because the formatter prefers single quotes for those and the quality profile does not. Everything else came from the prompt.

Resist the temptation to tune code against individual rules. The goal is the fix batch a team would actually accept from an AI assistant after a scan.

Upload the remediated archive to the same project with the same languages, cqLanguages, and triage flags as the baseline scan. Pass uuid instead of name so the scan joins the existing project.

Security findings dropped from 31 to 5 and the score rose from 16 to 65. Lines of code grew from 630 to 822, because bcrypt, HMAC signing, CSRF verification, path validation, and input allowlists all add code — so the score improved despite a larger denominator.

Compare rule families rather than the headline score alone. Weak hashing, insecure randomness, hardcoded credentials, plain-HTTP egress, and all three cookie rules went to zero.

Open the detailed results for the rescan. JS_CRYPTO_BAD_HASH, JS_CRYPTO_BAD_RANDOM, JS_CRYPTO_KEY_HARDCODED, JS_PASSWORD_HARDCODED, JS_HTTP_USAGE, JS_BACKDOOR_NETWORK_ACTIVITY, and all three cookie rules are gone. SQL injection fell from fourteen hits to two.

The five remaining findings sit in two places. Three JS_XSS_REFLECTED hits are on the HTML report preview, which now escapes every interpolated value through escape-html and sends a restrictive Content-Security-Policy header. Two JS_INJECTION_SQL hits are on the shipment search, where the sort and filter column names are interpolated after being checked against an allowlist while the values themselves are bound as parameters.

Both need a reviewer to look at the code and sign off, not another automated pass. That is the honest end state of a two-prompt remediation: most families cleared outright, and a short list left that a person closes.

The CQ score moved from 1 to 92 and critical Code Quality findings went from 431 to zero. Every critical rule cleared: 211 single-quote hits, 120 quote-formatting hits, 89 var usages, 8 thrown string literals, 2 eval calls, and the unguarded for…in loop.

The 315 remaining findings are all medium or low — indentation, block style, spacing, line length, variable grouping, and one constructor-naming rule. They are worth a formatter pass in CI rather than a prompt.

Read this alongside the security rescan rather than on its own. The two eval calls counted once as a critical quality finding and again as the dynamic-execution risk a reviewer cares about, and one remediation removed both.

Pull critical, medium, low, score, and loc together with criticalCq, mediumCq, lowCq, scoreCq, and locCq from the scan DTO, group findings by ruleId, and lay both slices out in one Cursor Canvas panel.

The baseline hybrid view puts the security story and the quality story side by side — 31 findings at score 16 next to 700 quality findings at score 1 — which is the framing a stakeholder needs before seeing the rescan.

Reuse the layout with the rescan UUID and split each slice into what remains and what cleared outright. The cleared column is the part worth showing to whoever approved the remediation work.

On this capture the after panel shows 5 security findings at score 65 and zero critical quality findings at score 92, with ten rule families listed as cleared.

Add a third Canvas that plots baseline and after counts side by side by rule family — SQL injection, weak crypto and randomness, plain HTTP and egress, cookie flags, hardcoded secrets, and reflected XSS.

Include a short score-context note. Both scans cover the same project with the same rule set, so the scores are comparable, but lines of code grew from 630 to 822 and readers should know why before they read a fourfold score improvement.

Open Scans Comparison and select the baseline and after scans. The chart splits findings into remaining, fixed, and new by severity, and the SAST/CQ toggle above the scan pickers switches between the two slices.

The SAST view shows the twenty-four medium findings as fixed with two remaining. The CQ view shows all 431 critical findings fixed, with the low-severity count rising as the formatting rules redistributed across a larger file set.

Use this view alongside the Canvas panels — product interface for drill-down, Canvas for the combined story you export.

Switch the toggle to CQ on the same comparison. The critical column shows 431 findings fixed and none remaining, which is the clearest single view of the quality result.

The rising low-severity column is expected. Formatting rules scale with file count and line count, and the remediated archive is larger.