Claude Can't Say "Done" Until the Code Is Safe: A Security Verification Loop for Claude Code

A developer built a security verification loop for Anthropic's Claude Code using the tool's Stop hook, which blocks the agent from declaring a task complete until its code changes pass five security pattern checks. On a test repository, the first completion attempt was blocked with five findings, prompting Claude to move an API call to a server route and switch to textContent and JSON.parse before the hook passed. The hook caps retries at three attempts per session before writing a report for human review, and the author notes the rules are pattern-based rather than a substitute for full SAST or code review.

I asked Claude Code to add an AI chat feature. It worked. It also: Then it said, "All done " 🙃 Anthropic's Claude Code team recently wrote about verification loops: Claude checks its own work and loops back to fix problems before responding. Most examples verify that tests pass. Nobody was verifying that the code was safe. So I built that. Claude Code hooks run your scripts at fixed moments. The Stop hook fires when Claude is about to finish. If the hook exits with code 2, Claude isn't allowed to stop, and whatever you print to stderr is sent back to it as feedback. That's the whole loop: Claude says done → hook scans the diff → exit 2 with findings → Claude fixes → hook passes → done. Step 1: register the hook .claude/settings.json { "hooks": { "Stop": { "hooks": { "type": "command", "command": "node \"$CLAUDE PROJECT DIR\"/.claude/hooks/security-verify.mjs" } } } } The hook scans only the lines Claude changed git diff HEAD -U0 plus new files , so old code never blocks you. Five rules, each aimed at a mistake AI code actually makes: js const RULES = { id: 'hardcoded-secret', test: l = /sk- ant-|proj- ? \w- {20,}|AKIA 0-9A-Z {16}/.test l }, { id: 'secret-in-client-bundle', test: l = / NEXT PUBLIC |VITE \w KEY|SECRET |dangerouslyAllowBrowser:\s true/.test l }, { id: 'llm-output-as-html', test: l = /innerHTML|dangerouslySetInnerHTML/.test l && /\b reply|response|completion /i.test l }, { id: 'unsafe-html-sink', test: l = isDynamicHtml l }, // static strings are allowed { id: 'dynamic-code-exec', test: l = /\beval\s \ |new\s+Function\s \ /.test l }, ; llm-output-as-html is the one I care most about. Suppose a prompt injection gets into your model's reply; innerHTML = reply hands the attacker XSS. Model output is untrusted input, always. js const findings = scan changedLines ; if findings.length === 0 process.exit 0 ; // clean: Claude may finish if attempts MAX ATTEMPTS { // stuck: hand over to the human writeFileSync '.claude/security-report.md', report ; process.exit 0 ; } console.error security-verify blocked completion:\n${report} ; process.exit 2 ; // Claude must keep working The attempt cap matters. A Stop hook that always exits 2 can loop forever. I count attempts per session and, after 3 tries, stop blocking and write a report for a human instead. The hook says what is wrong. A skill in .claude/skills/security-verify/SKILL.md says how to fix it: move keys behind a server route, use textContent or DOMPurify.sanitize , use JSON.parse instead of eval. It also tells Claude not to just rephrase code to dodge the regex. False positive? Claude can add // verify-ignore: on that line, and it has to tell you why. The opt-out is visible in review, not silent. On my test repo, the first "done" was blocked with 5 findings. Claude moved the API call to a server route, switched to textContent and JSON.parse, the hook passed, and its final message told me to rotate the key that had already appeared in the diff. That last part is the real win: I didn't have to remember to check. These are pattern rules, not a full security audit. They catch the common AI mistakes cheaply on every single turn. Keep your real SAST, code review, and secret scanning in CI too. 📦 Get the drop-in .claude folder hook + settings + skill, zero dependencies : https://github.com/thesnehamk/discovering-ai/tree/main/claude-code-security-verify.