Initial Scan

In this lesson we perform a focused security audit of our Express application using Claude Code. The goal is to identify and prioritize security issues, produce actionable recommendations, and generate Markdown reports stored in an audits/ folder. We won’t necessarily fix every issue immediately—this scan creates a repeatable baseline you or another developer can act on. Why this matters: authentication endpoints, database access, and middleware configuration are high-risk areas. Claude Code accelerates the discovery process (including optional npm audit) and helps you produce handoff-ready reports.

Quick start — inspect the repo with Claude Code

Start Claude Code and let it inspect the repository. The interactive welcome and working directory might look like this:

* Welcome to Claude Code!

/help for help, /status for your current setup

cwd: /Users/jeremy/Repos/Claude Code Course/Express-login-demo

> Try "fix lint errors"

? for shortcuts

In SECURITY_AUDIT_REPORT.md

Create an audits/ folder and save reports there so they are versioned with your repo and simple to share.

Initial project analysis: sample prompt

Use a single focused prompt to locate entry points, middleware, auth flows, and other attack surfaces. Example prompt we use to drive the initial analysis:

Perform a Project Structure Audit

Analyze the entire project structure and identify:

1. All entry points (app.js, server.js, etc.)
2. All routes and endpoints
3. Middleware chain and order
4. External service integrations
5. Database connection points
6. Authentication/authorization flow
7. File upload handling locations
8. API rate limiting implementation

Start by examining these core files:
- package.json (for vulnerable dependencies)
- app.js or server.js (for middleware configuration)
- All files in routes/
- All files in middleware/

Create a security audit report with initial risk assessment.

Claude Code will traverse files and may run additional checks (for example npm audit) if you allow it. During the scan you may see output like:

Read 98 lines (ctrl+r to expand)

Read(config/database.js)
└ Read 19 lines (ctrl+r to expand)

Read(schema.sql)
└ Read 22 lines (ctrl+r to expand)

Update Todos
└ Analyze project structure and identify entry points
☐ Examine package.json for vulnerable dependencies
☐ Analyze server.js for middleware configuration
☐ Review all route files for security vulnerabilities
☐ Check authentication/authorization implementation
☐ Analyze database connection and query security
☐ Check for rate limiting and security headers
☐ Create comprehensive security audit report

Bash (npm audit --audit-level moderate)
└ Running…

Do you want to proceed?
> 1. Yes
  2. Yes, and don't ask again for npm audit commands in /Users/jeremy/Repos/Claude Code Course/Express-login-demo
  3. No, and tell Claude what to do differently (esc)

Choose whether to permit npm audit based on your workflow. Running it often uncovers known-vulnerability flags in dependencies and helps prioritize fixes.

Creating the audit report

Claude Code can create the audits/ directory and write a Markdown report for you. You will typically be asked to confirm edits before they are committed:

• Bash(mkdir -p audits)
  (No content)

• Write(audits/SECURITY_AUDIT_REPORT.md)

Opened changes in Visual Studio Code
Save file to continue.

Do you want to make this edit to SECURITY_AUDIT_REPORT.md?
  1. Yes
  2. Yes, for this session only (shift+tab)
  3. No, and tell Claude what to do differently (esc)

After accepting, you have a baseline report that documents entry points, risks, and prioritized recommendations. Below is an excerpt of a generated security audit. It highlights core components and high-priority findings with recommendations you can action immediately.

Project structure & core components

Database: PostgreSQL with pg driver
Authentication: JWT for tokens and bcrypt for password hashing
Validation: express-validator

Actionable findings summary

Vulnerability	Affected files	Risk Level	Recommendation
Missing security headers	`server.js:1-19`	`CRITICAL`	Add `helmet` middleware and configure HSTS, CSP, X-Frame-Options
No rate limiting	`server.js:1-19`, `routes/auth.js:9-96`	`CRITICAL`	Add `express-rate-limit` to auth routes with IP-based throttling
JWT secret not validated	`routes/auth.js:53`	`CRITICAL`	Validate `JWT_SECRET` at startup (fail-fast if missing or weak)
Verbose error messages / info leak	various	`HIGH`	Return generic client errors and log details server-side securely

Full report entries include file locations, risk descriptions, impact statements, and remediation steps so developers can triage based on severity. You can export these Markdown reports to Google Docs, Word, or share them directly with stakeholders. Claude Code also generates convenient “Immediate Action Items” lists for rapid remediation planning.

A screenshot of a Google Docs document showing a security audit report with a highlighted "Immediate Action Items" numbered list and a "Long-term Security Enhancements" section. The doc's left sidebar lists risk categories, and the window is over a code editor/IDE in the background.

The prompts used in this lesson are available at github.com/JeremyMorgan/claude-code-reviewing-prompts. They are released under Creative Commons—feel free to reuse and adapt them.

How to use the audit outputs

Prioritize fixes by risk level (CRITICAL → HIGH → MEDIUM → LOW).
Create small PRs that address one class of issues (e.g., add helmet, then add rate limiting).
Re-run Claude Code after changes to validate fixes and detect regressions.
Keep audits/SECURITY_AUDIT_REPORT.md updated and link it in your project README for visibility.

Next steps: deep dive into authentication

This initial scan surfaces broad issues. Next, we’ll deep dive into the authentication flow—login, token handling, and session management—because these endpoints are frequent targets. Subsequent sections will analyze the login and token code in detail and show how to harden them using Claude Code-driven checks and automated report updates.

Introduction

Getting Started with Claude Code

Working with Claude Code

Code Review with Claude Code

Security Auditing with Claude Code

Advanced Features

Quick start — inspect the repo with Claude Code

Initial project analysis: sample prompt

Creating the audit report

Project structure & core components

Actionable findings summary

How to use the audit outputs

Next steps: deep dive into authentication

Links and references

Watch Video

​Quick start — inspect the repo with Claude Code

​Initial project analysis: sample prompt

​Creating the audit report

​Example excerpt: Security Audit Report (Express Login Demo)

​Project structure & core components

​Actionable findings summary

​How to use the audit outputs

​Next steps: deep dive into authentication

​Links and references

Watch Video

Quick start — inspect the repo with Claude Code

Initial project analysis: sample prompt

Creating the audit report

Example excerpt: Security Audit Report (Express Login Demo)

Project structure & core components

Actionable findings summary

How to use the audit outputs

Next steps: deep dive into authentication

Links and references