Anthropic already ships free security tools. Here's exactly what ours adds — and when it doesn't.

Claude Code has a free /security-review slash command, and Anthropic publishes a free, open-source claude-code-security-review GitHub Action. Both are good. Neither is what our $29 pack is selling. This page names the real difference so you can decide with full information — not marketing.

tl;dr: we don't win on "can review your code at all" — Anthropic's own tools already do that. We win on curation, breadth across stacks, and the process artifacts (checklists, worked example, multi-editor support) built around that raw capability. If that's not worth $29 to you, use the free tools — genuinely, we mean that.

Feature-by-feature comparison

	Claude Code `/security-review`	Anthropic `claude-code-security-review` Action	AI Coding Security Pack
What it is	Built-in slash command, ships with Claude Code	Free, open-source (MIT) GitHub Action, official Anthropic repo	Downloadable pack of subagents, commands, rules files, and checklists you drop into your own project
Cost	No extra cost — included if you're already on a Claude Code plan or pay-as-you-go API Console account	Free/MIT license itself, but it calls the Claude API to run — you supply your own API key and pay for that usage	$29 one-time, free updates for life
When it runs	Manually, on demand, from your terminal — "before committing code"	Automatically on every pull request (diff of changed files), or every commit if configured	Whenever you invoke a command or subagent — diff review, pre-deploy gate, dependency change, or design time (threat modeling), your call on cadence
Vulnerability classes covered	SQL injection, XSS, auth flaws, insecure data handling, dependency issues — general vulnerability patterns	Injection (SQL/command/LDAP/XPath/NoSQL/XXE), auth & authz flaws, data exposure, crypto issues, input validation, business-logic flaws, supply chain, XSS — broad, language-agnostic; explicitly filters out DoS/rate-limit/generic-validation noise	Same broad classes, split across 5 purpose-built subagents so authorization/IDOR and secrets get a dedicated deep pass instead of one generalist scan
Process artifacts	None — it's a scan, not a workflow	PR comments; no checklists or playbooks	3 checklists (pre-deploy gate, incident-response quickref, dependency review), a `/threat-model` command for design time, a GUIDE.md on why AI code fails this way
See output before you commit to it	No — you run it on your own code to find out	No — but it's open source, you can read the code	Yes — `examples/example-review-transcript.md` is a full worked review on a realistic vulnerable diff, same one shown on the product page
Editor / tool support	Claude Code only	Runs via CI, calling the Claude Code CLI — not tied to your local editor	Native in Claude Code (`.claude/agents`, `.claude/commands`); every agent also ships a Cursor / Windsurf / Devin / Copilot mapping note
Stack-specific guidance	General — no per-stack rules files	General — no per-stack rules files	6 addenda (Node/TS, Python, web frontend, infra/DevOps, Go, Rust) to paste into your `CLAUDE.md`/`AGENTS.md`
Auto-fixes your code	No — reports and explains, you approve any fix	No — posts PR comments, doesn't push commits	No — every agent and command is explicitly read-only by design, same as the free tools
Best fit	A quick check before you commit, right now, zero setup	A CI gate on every PR without anyone remembering to run anything manually	A team that wants the checks plus the surrounding process — checklists, threat modeling, multi-stack rules, non-Claude-Code editor support — as one curated drop-in

We recommend using these together, not instead of each other. The pack's own /security-review and security-reviewer subagent don't replace Anthropic's command — they're built to run alongside it, with the pack adding the narrower deep passes (auth-flow-reviewer for IDOR/session bugs, secrets-auditor, dependency-auditor) and the checklists/threat-modeling that a single scan command doesn't attempt. If you're serious about this, wire in the free GitHub Action for CI and keep this pack's checklists for the parts a diff-time scan can't see (design-time threat modeling, pre-deploy gate, incident response).

When NOT to buy this

Genuine anti-pitch — if any of these describe you, save the $29:

You're on a solo hobby project with nothing sensitive at stake. Run /security-review before you commit and call it done. That's exactly what it's for.
You already have a security team with its own playbooks. This pack is a starting point for teams that don't have one yet. If yours already has curated checklists, threat-modeling templates, and incident response docs, ours won't tell you anything new.
You don't use Claude Code or any AI coding assistant. The subagents and slash commands need an AI coding tool to run in (Claude Code natively, or a paste-in for Cursor/Windsurf/ Devin/Copilot). If you're not using one of those, the free Action is still useful for CI, but the pack's install path doesn't apply to you.
Your CI already runs the free Anthropic Action and that's covering your PRs. If the free Action's PR comments are already catching what you need and nobody on the team wants checklists or a threat-modeling command, you don't need this pack to get more coverage — you'd be paying for artifacts you won't use.
You handle regulated data (PCI/HIPAA/SOC 2) and need a compliance audit. Neither the free tools nor this pack are a substitute for a professional penetration test or compliance audit — the pack says so explicitly in its own honest-scope note. Bring in a human or a specialized auditor for that; don't expect any Claude-based tool to sign off on compliance.

Still think the curation, checklists, and multi-stack rules are worth it for your team?

See the full pack — $29 → See it catch a real bug ↓

Checkout (via Stripe) is on the pack page — instant download the moment payment clears, free updates for life.

Sources for the free-tool descriptions above: Anthropic's claude-code-security-review GitHub repo and the Claude Code Help Center article on automated security reviews, both checked 2026-07-07.