Security loops

Bounded security sweeps: dependency audits, secret scans, and CVE burn-downs that report before they touch anything.

5 graded loops in this category.

Burn down critical security findings

Loop/looplooprepoA

Run your static analyzer on the security ruleset, fix one high-severity finding at a time, re-verify, and loop until zero remain or 10 turns pass.

prompt
→ Claude Code
/loop run the repo's static analyzer (semgrep, CodeQL, or whatever is already configured) with the security ruleset; take ONE finding — highest severity first — and fix it minimally, then re-run the analyzer to verify the finding is gone and run the test suite. Never suppress or downgrade a rule to make a finding disappear; anything that needs a design change gets flagged for human review instead. Continue until the analyzer reports zero findings at high severity — stop after 10 turns and propose the fixes as one PR.
securitymedium risk
claude-code

Secrets scan until clean

Loop/goallooprepoB

Run a secrets scanner over the working tree and drive the findings to zero: real secrets get flagged for rotation, false positives get baselined.

prompt
→ Claude Code
/goal `gitleaks detect --no-git` reports zero findings — for each finding, tell me whether it looks like a real credential (flag it for rotation and replace it with an env var lookup) or a false positive (add it to the baseline with a comment); never print the secret value itself; stop after 8 turns
securitylow risk
claude-codecodex
looprepo ↗

Lock down Supabase RLS policies

Loop/goalGitHubB

Replace overpermissive 'always true' policies with org-scoped RLS across six tables until security advisor clears all findings.

prompt
→ Claude Code
/goal In Supabase prod project udooysjajglluvuxkijp, replace each authenticated write <table> ALL policy on public.customers/orders/order items/quotes/quote items/products (currently USING + WITH CHECK both literally true) with an org/tenant-scoped USING + WITH CHECK, or drop the policy if the table is unused in RA. End state: get advisors(project id=udooysjajglluvuxkijp, type:security) returns 0 rls policy always true findings for those 6 tables. Or stop after 6 turns if the owning tenant column cannot be confirmed
securityhigh risk
claude-code
CleanExpo ↗

Cadence: weekly. you are my expectation-gap auditor. read…

Loop/loopXA

Community loop loop for security, sourced from submission. Verified exit condition, evaluator-gated.

prompt
→ Claude Code
/loop cadence: weekly. you are my expectation-gap auditor. read expectation-gap-STATE.md: gaps found, pages fixed, tickets already processed. pull the week's support tickets and refund reasons [Zendesk MCP / your support export]. each round, take ONE "i thought" moment where the customer expected something the product doesn't do; find the sentence on my site that planted the expectation and log both side by side. for the pain that cost the most (refunds, angriest tickets), draft the page fix (exact promise) or flag me if the product should change instead. append pairs, sources and the drafted fix to expectation-gap-STATE.md; never edit shipped pages yourself, draft only. verification: a round is valid only when the pair and drafted fix are appended and readable in expectation-gap-STATE.md. stop after 15 iterations, or until every new gap this week is logged, whichever comes first; if the support source is unreachable, BLOCK and say so.
securityhigh risk
claude-code
mcp-community ↗

→ run /audit-skills every Monday morning

Loop/scheduleGitHubA

Community schedule loop for security, sourced from github. Verified exit condition, evaluator-gated.

prompt
→ Claude Code
/schedule → run /audit-skills every Monday morning Guardrails: Stop when the goal is verifiably met, or stop after 15 iterations, whichever comes first. Verify each pass by running the relevant tests or checks — self-reported success does not count. Keep changes minimal and never touch files outside the task’s scope.
securityhigh risk
claude-code
jennydove ↗