Security audit your web app with Claude Code: how to use the Cloudflare skill that found over 7,000 vulnerabilities

With Claude Code you can run a full security check of your web app for free, using security-audit: the skill Cloudflare used to find more than 7,000 vulnerabilities in its own code and then published on GitHub. You install it with one sentence, launch it with another, and end up with a report that only contains proven vulnerabilities. I ran it on my own web app: 28 minutes, 38 agents, no critical vulnerabilities and 5 real issues.

The steps, in the order I followed them:

1. Find Cloudflare’s skill on GitHub
2. Install it in Claude Code with one sentence
3. Run the security audit on the web app
4. Understand how the agents find and verify vulnerabilities
5. Approve Docker for the sandbox
6. Read the report
7. Have Claude Code fix the vulnerabilities and run the skill again

What is Cloudflare’s security-audit skill?

security-audit is a coding agent skill that runs a multi-phase security audit of your code and produces a report with independently verified findings. The repository is cloudflare/security-audit-skill, under the MIT license.

Cloudflare is the company behind the "Verify you are human" box you see on countless websites. In the post Build your own vulnerability harness it explains that this skill was the starting point of the system it used to hunt for vulnerabilities in its own repositories: in the end, 7,245 vulnerabilities were left for engineering teams to fix.

After it was published on GitHub, the repository passed 48,000 stars within a few weeks.

How do you install the skill in Claude Code?

You don’t need any command to install security-audit. Open Claude Code in the folder of the web app you want to analyze and type:

install this skill https://github.com/cloudflare/security-audit-skill

Before installing it, Claude Code reads the skill and checks that it does nothing suspicious, such as sending your files over the internet. Then it adds it to your skills, and you can use it right away without restarting Claude Code.

If you prefer the terminal, the repository README also lists the command npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit.

How do you run the security audit on your web app?

I ran it on aibuildersitalia.com, the platform of my academy. It’s a good test case: it has login, sign-up, payments and a members-only area. All of these are features that need to be secured.

I opened Claude Code in the project folder and typed:

run a full security audit of this project

First, the skill studies how the project is built. Then it asks for permission to install Docker and create a sandbox: on my Mac, Claude Code offered to install OrbStack, which includes Docker, with brew install --cask orbstack. I approved it.

If your project is small or you only want a first look, you can ask Claude Code for the quick profile. I had it run the full audit, and I recommend you do the same, especially the first time you run the skill. On my web app the full run took 28 minutes.

How does the skill work: who finds the vulnerabilities and who verifies them?

The security-audit skill splits the project into zones and sends a different agent to check each one. On my web app there were 27 zones: one agent on login, one on payments, one on the members area and so on. Two extra agents work across the whole project: one looks for the most obvious mistakes, the other for the most unusual ones.

The problem with AI hunting for security vulnerabilities is that it finds a huge number of them, and some are false alarms. That’s why every vulnerability found is handed to another agent, which didn’t find it and has a single job: prove it wrong. Only the vulnerabilities that survive this test make it into the final report.

In total, the skill worked with 38 agents on my project.

Cloudflare adds a figure that changes how you should use it: according to its coverage metrics, a single run finds only about half the vulnerabilities you’d catch across multiple runs. So it pays to run the skill more than once, especially after changing the code.

Why does the skill need Docker?

To be sure a vulnerability really exists, the skill has to try to attack your app. Doing that on the real app or directly on your computer would be risky: the agent could touch files it shouldn’t touch or read data it shouldn’t access.

That’s why security-audit creates a sandbox, a closed room: a small computer inside your computer, holding a copy of your app. The sandbox has no internet access, can’t see your passwords, can only write to the folder assigned to it and has memory and time limits. Inside this controlled environment Claude Code can try the attacks without causing damage. Creating it requires Docker, which is why Claude Code asks for permission.

Without a sandbox, for example if you don’t have Docker, the skill executes nothing. It reads the code and flags possible vulnerabilities as "needs validation", without confirming them through an attack. To get the full run, it’s worth installing the sandbox.

What did the skill find on my web app?

After 28 minutes the report was ready. The good news: no critical vulnerabilities. Nobody can get in without a password, no member can see another member’s data and payments are checked properly.

The skill did find 5 real issues, though. Here are two of them.

The old link that reopened an expired membership

The most serious issue concerned people who had paid once but never set a password. That user could become a member again even after the subscription had expired and I had removed their access. All it took was reusing the old link received after payment.

The skill didn’t just report it. It tried the attack in the sandbox, with fake data, and saw the members-only page go from "access denied" to open.

The logout that didn’t close the old session

The second issue was about logging out. If someone steals access to your account, the normal reaction is to change the password or sign out of all devices. On my web app that wasn’t enough: the old session stayed valid for 30 days.

For each vulnerability, the report explains the cause and the smallest fix needed, meaning the bare minimum to solve the problem without touching anything else.

How do you get Claude Code to fix the vulnerabilities?

The skill’s report is ready to hand to Claude Code. Open a new session, give it the report and type:

fix the vulnerabilities reported in this report

For each vulnerability, Claude Code reads the cause and the minimal fix listed in the report, then applies it. When it has doubts, it stops and asks questions.

Once the fixes are done, run the skill again with the same prompt as before, run a full security audit of this project, to check that the vulnerabilities are gone.

Is an audit after development enough?

Cloudflare’s skill finds the vulnerabilities of a web app that’s already built, maybe weeks earlier. Ideally you catch them before the app goes live, laying secure foundations from the first day of development: the practice known as secure development.

I’m running a free online workshop on this on November 10 at 9 PM Italian time: I build a test web app, show how it gets attacked and how the vulnerability is fixed. The workshop is in Italian, and you can sign up at aibuildersitalia.com/workshop. If you want to start right away, I’ve collected 4 security checks to run before launching an app built with AI.

If you’ve just launched an app built with AI, this is the check to run today, before someone else runs it for you.

Clips from the video