Security Plugin Pack - Quick Start Guide

Security Plugin Pack - Quick Start Guide

Get started with the Claude Code Security & Compliance Plugin Pack in 5 minutes.

Installation

# Add the marketplace (if not already added)
/plugin marketplace add jeremylongshore/claude-code-plugins

# Install individual plugins
/plugin install vulnerability-scanner@claude-code-plugins-plus
/plugin install secret-scanner@claude-code-plugins-plus
/plugin install dependency-checker@claude-code-plugins-plus

Your First Security Scan (1 minute)

# 1. Scan for exposed secrets (ALWAYS run this first!)
/secrets

# 2. Check for vulnerabilities in dependencies
/depcheck

# 3. Run comprehensive vulnerability scan
/vuln

Common Security Workflows

Pre-Commit Security Check (2 minutes)

/secrets          # Check for exposed API keys
/depcheck         # Check dependency CVEs

Pre-Deployment Check (5 minutes)

/vuln             # Full vulnerability scan
/secrets          # Secret scanning
/depcheck         # Dependency check
/owasp            # OWASP compliance
/headers          # Security headers

Compliance Audit (10 minutes)

/auditreport      # Generate security audit
/gdpr             # GDPR compliance
/pci              # PCI DSS validation
/soc2             # SOC2 audit prep

Deep Security Testing (30 minutes)

/sqli             # SQL injection detection
/xss              # XSS vulnerability scanning
/csrf             # CSRF protection
/authcheck        # Authentication validation
/session          # Session security
/pentest          # Penetration testing

Most Important Plugins (Start Here)

1. Secret Scanner

/secrets
# Prevents committing API keys, passwords, tokens
# Run BEFORE every commit!

2. Vulnerability Scanner

/vuln
# Comprehensive security scan
# Run before every deployment

3. Dependency Checker

/depcheck
# Finds vulnerable npm/pip/composer packages
# Run weekly

4. OWASP Compliance

/owasp
# Checks OWASP Top 10 compliance
# Target: 90%+ compliance

5. SQL Injection Detector

/sqli
# Finds SQL injection vulnerabilities
# Most critical vulnerability type

Quick Command Reference

Understanding Security Reports

Severity Levels

• CRITICAL (9.0-10.0) - Fix immediately (hours)
  • Example: SQL injection, remote code execution
• HIGH (7.0-8.9) - Fix within 7 days
  • Example: Authentication bypass, XSS
• MEDIUM (4.0-6.9) - Fix within 30 days
  • Example: Missing security headers
• LOW (0.1-3.9) - Fix when possible
  • Example: Informational findings

Reading a Report

VULNERABILITY SCAN REPORT
=========================
Critical: 2    <-- FIX IMMEDIATELY
High: 5        <-- FIX THIS WEEK
Medium: 8      <-- FIX THIS MONTH
Low: 12        <-- BACKLOG

[Detailed findings with:]
- Vulnerable code location
- Exploitation example
- Fix recommendation
- Code example (secure version)

Common Security Issues & Fixes

1. Exposed Secrets

Problem: API key in code
Fix: Use environment variables
Command: /secrets

2. SQL Injection

Problem: String concatenation in queries
Fix: Use parameterized queries
Command: /sqli

3. Vulnerable Dependencies

Problem: Outdated packages with CVEs
Fix: Update dependencies
Command: /depcheck

4. Missing Security Headers

Problem: No Content-Security-Policy
Fix: Add security headers
Command: /headers

5. Weak Authentication

Problem: No password requirements
Fix: Implement strong password policy
Command: /authcheck

Integration Examples

Git Pre-Commit Hook

# .git/hooks/pre-commit
#!/bin/bash
/plugin secret-scanner || exit 1
echo " Security check passed"

CI/CD Pipeline

# .github/workflows/security.yml
- name: Security Scan
  run: |
    /plugin vulnerability-scanner
    /plugin secret-scanner
    /plugin dependency-checker

Best Practices

Daily

• Run /secrets before committing
• Review security logs

Weekly

• Run /depcheck for dependency updates
• Review vulnerability backlog

Before Deployment

• Run /vuln for full scan
• Run /owasp for compliance
• Verify all CRITICAL and HIGH issues fixed

Quarterly

• Run /auditreport for comprehensive audit
• Run /pentest for penetration testing
• Review compliance (/gdpr, /pci, /soc2)

Get Help

Each plugin has detailed documentation:

# View plugin documentation
cd /path/to/plugin
cat README.md

Next Steps

1. Install your first 3 plugins (secrets, vuln, depcheck)
2. Run your first security scan
3. Fix CRITICAL issues
4. Set up pre-commit hook
5. Add to CI/CD pipeline
6. Schedule weekly dependency checks
7. Plan quarterly security audits

Troubleshooting

Plugin not found?

# Check marketplace is added
/plugin marketplace list

# Add marketplace if missing
/plugin marketplace add jeremylongshore/claude-code-plugins

False positives?

# Review finding carefully
# Document why it's not a real issue
# Add to security exceptions

Too many findings?

# Prioritize by severity
# Fix CRITICAL first
# Then HIGH, MEDIUM, LOW
# Track progress in issues

Support

• Documentation: Each plugin has comprehensive README
• Examples: Code examples in READMEs
• Issues: Report bugs via GitHub issues

Ready to secure your codebase?

Start with: /secrets → /depcheck → /vuln

Happy securing!