I asked Claude Code to add an AI chat feature. It worked. It also:
Then it said, "All done!" 🙃
Anthropic's Claude Code team recently wrote about verification loops: Claude checks its own work and loops back to fix problems before responding. Most examples verify that tests pass. Nobody was verifying that the code was safe. So I built that.
Claude Code hooks run your scripts at fixed moments. The Stop hook fires when Claude is about to finish. If the hook exits with code 2, Claude isn't allowed to stop, and whatever you print to stderr is sent back to it as feedback.
That's the whole loop:
Claude says done → hook scans the diff → exit 2 with findings → Claude fixes → hook passes → done.
Step 1: register the hook
.claude/settings.json
{
"hooks": {
"Stop": [{
"hooks": [{
"type": "command",
"command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/security-verify.mjs"
}]
}]
}
}
The hook scans only the lines Claude changed (git diff HEAD -U0 plus new files), so old code never blocks you. Five rules, each aimed at a mistake AI code actually makes:
const RULES = [
{ id: 'hardcoded-secret', test: l => /sk-(ant-|proj-)?[\w-]{20,}|AKIA[0-9A-Z]{16}/.test(l) },
{ id: 'secret-in-client-bundle', test: l => /(NEXT_PUBLIC_|VITE_)\w*(KEY|SECRET)|dangerouslyAllowBrowser:\s*true/.test(l) },
{ id: 'llm-output-as-html', test: l => /innerHTML|dangerouslySetInnerHTML/.test(l) && /\b(reply|response|completion)/i.test(l) },
{ id: 'unsafe-html-sink', test: l => isDynamicHtml(l) }, // static strings are allowed
{ id: 'dynamic-code-exec', test: l => /\beval\s*\(|new\s+Function\s*\(/.test(l) },
];
llm-output-as-html is the one I care most about. Suppose a prompt injection gets into your model's reply; innerHTML = reply hands the attacker XSS. Model output is untrusted input, always.
const findings = scan(changedLines());
if (findings.length === 0) process.exit(0); // clean: Claude may finish
if (attempts > MAX_ATTEMPTS) { // stuck: hand over to the human
writeFileSync('.claude/security-report.md', report);
process.exit(0);
}
console.error(`security-verify blocked completion:\n${report}`);
process.exit(2); // Claude must keep working
The attempt cap matters. A Stop hook that always exits 2 can loop forever. I count attempts per session and, after 3 tries, stop blocking and write a report for a human instead.
The hook says what is wrong. A skill in .claude/skills/security-verify/SKILL.md says how to fix it: move keys behind a server route, use textContent or DOMPurify.sanitize(), use JSON.parse instead of eval. It also tells Claude not to just rephrase code to dodge the regex.
False positive? Claude can add // verify-ignore: on that line, and it has to tell you why. The opt-out is visible in review, not silent.
On my test repo, the first "done" was blocked with 5 findings. Claude moved the API call to a server route, switched to textContent and JSON.parse, the hook passed, and its final message told me to rotate the key that had already appeared in the diff.
That last part is the real win: I didn't have to remember to check.
These are pattern rules, not a full security audit. They catch the common AI mistakes cheaply on every single turn. Keep your real SAST, code review, and secret scanning in CI too.
📦 Get the drop-in .claude folder (hook + settings + skill, zero dependencies):