Claude Can't Say "Done" Until the Code Is Safe: A Security Verification Loop for Claude Code

I asked Claude Code to add an AI chat feature. It worked. It also:

• hardcoded my API key,
• rendered the model's reply with innerHTML,
• and ran eval() on it.

Then it said, "All done!" 🙃

Anthropic's Claude Code team recently wrote about verification loops: Claude checks its own work and loops back to fix problems before responding. Most examples verify that tests pass. Nobody was verifying that the code was safe. So I built that.

How it works

Claude Code hooks run your scripts at fixed moments. The Stop hook fires when Claude is about to finish. If the hook exits with code 2, Claude isn't allowed to stop, and whatever you print to stderr is sent back to it as feedback.

That's the whole loop:

Claude says done → hook scans the diff → exit 2 with findings → Claude fixes → hook passes → done.

Step 1: register the hook

.claude/settings.json

{
  "hooks": {
    "Stop": [{
      "hooks": [{
        "type": "command",
        "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/security-verify.mjs"
      }]
    }]
  }
}

Step 2: the rules

The hook scans only the lines Claude changed (git diff HEAD -U0 plus new files), so old code never blocks you. Five rules, each aimed at a mistake AI code actually makes:

const RULES = [
  { id: 'hardcoded-secret',        test: l => /sk-(ant-|proj-)?[\w-]{20,}|AKIA[0-9A-Z]{16}/.test(l) },
  { id: 'secret-in-client-bundle', test: l => /(NEXT_PUBLIC_|VITE_)\w*(KEY|SECRET)|dangerouslyAllowBrowser:\s*true/.test(l) },
  { id: 'llm-output-as-html',      test: l => /innerHTML|dangerouslySetInnerHTML/.test(l) && /\b(reply|response|completion)/i.test(l) },
  { id: 'unsafe-html-sink',        test: l => isDynamicHtml(l) }, // static strings are allowed
  { id: 'dynamic-code-exec',       test: l => /\beval\s*\(|new\s+Function\s*\(/.test(l) },
];

llm-output-as-html is the one I care most about. Suppose a prompt injection gets into your model's reply; innerHTML = replyhands the attacker XSS. Model output is untrusted input, always.

Step 3: block, with a way out

const findings = scan(changedLines());
if (findings.length === 0) process.exit(0);          // clean: Claude may finish

if (attempts > MAX_ATTEMPTS) {                        // stuck: hand over to the human
  writeFileSync('.claude/security-report.md', report);
  process.exit(0);
}
console.error(`security-verify blocked completion:\n${report}`);
process.exit(2);                                      // Claude must keep working

The attempt cap matters. A Stop hook that always exits 2 can loop forever. I count attempts per session and, after 3 tries, stop blocking and write a report for a human instead.

Step 4: teach Claude how to fix it

The hook says what is wrong. A skill in .claude/skills/security-verify/SKILL.md says how to fix it: move keys behind a server route, use textContent or DOMPurify.sanitize(), use JSON.parse instead of eval. It also tells Claude not to just rephrase code to dodge the regex.

False positive? Claude can add // verify-ignore: on that line, and it has to tell you why. The opt-out is visible in review, not silent.

The result

On my test repo, the first "done" was blocked with 5 findings. Claude moved the API call to a server route, switched to textContent and JSON.parse, the hook passed, and its final message told me to rotate the key that had already appeared in the diff.

That last part is the real win: I didn't have to remember to check.

Honest limits

These are pattern rules, not a full security audit. They catch the common AI mistakes cheaply on every single turn. Keep your real SAST, code review, and secret scanning in CI too.

📦 Get the drop-in .claudefolder (hook + settings + skill, zero dependencies):