ClaudeSec

AI Security Best Practices toolkit for secure development with Claude Code

ClaudeSec integrates security best practices directly into your AI-powered development workflow. It provides security-focused prompts, hooks, templates, and guides designed for use with Claude Code and CI/CD pipelines.

Quick Start

npx (no install)

npx claudesec scan                # Security scan — no install needed
npx claudesec dashboard           # Full scan + dashboard (safe local runner)

Verify supply-chain integrity (recommended)

ClaudeSec is published to npm with SLSA build provenance (attested via GitHub Actions OIDC trusted publishing). Verify the registry signature and provenance attestation before trusting an install:

npm install claudesec                  # add to a project
npm audit signatures                   # verifies npm signature + SLSA provenance

A healthy result reports the package as having a verified registry signature and attestation. Provenance links the published tarball back to the exact GitHub commit and workflow that built it (OWASP A08 — Software & Data Integrity Failures; SLSA).

Git clone + local-safe default

git clone https://github.com/Twodragon0/claudesec.git
cd claudesec
npm run dashboard                 # Safe mode (port fallback, no Docker requirement)
./scripts/quick-start.sh          # Docker-first mode (auto local fallback)

Claude Code slash commands

/scan                             # Run security scan on the current project
/compliance-check                 # Compliance gap analysis (NIST/ISO 27001/ISMS-P)
/dashboard                        # Build + serve dashboard
/security-review                  # Pre-commit security check
/hotfix                           # Fast-track CVE/threat response workflow
/new-guide                        # Author a security guide (multi-agent workflow)
/pipeline-review                  # Full DevSecOps pipeline review
/scanner-feature                  # Build a scanner feature (architect-to-CI)

Every name above is a file in .claude/commands/, kept in step by scanner/tests/test_ci_slash_command_sync.py. For a Prowler multi-cloud scan use the CLI (npx claudesec prowler) — it is not a slash command.

Dashboard serves at http://localhost:11777/

Options

npx claudesec scan                      # Scan only
npx claudesec prowler                   # Prowler multi-cloud scan (alias: scan -c prowler)
npx claudesec compliance iso27001       # Compliance gap scan (default: isms-p)
npx claudesec dashboard                 # Full scan + dashboard
./scripts/quick-start.sh --scan-only    # Scan + dashboard build only (no serve)
./scripts/quick-start.sh --serve        # Serve existing dashboard
./scripts/quick-start.sh --docker-only  # Fail fast when Docker is unavailable

Asset Management Dashboard (optional — requires API keys)

cp .env.example ~/Desktop/.env          # Edit with your API keys
./scripts/setup.sh                      # Install hooks + templates
./scripts/setup-legal-intel.sh          # Optional: local legalize-kr mirror + GitHub Repo MCP
source .venv-asset/bin/activate
python3 scripts/build-dashboard.py      # Build asset dashboard
docker compose up dashboard -d          # Serve on localhost:11777

Requires: Docker Desktop. See .env.example for API key setup.

Command	What it does
./run	Full scan + dashboard + serve at localhost:11777 (safe mode: --kill-port)
./run --no-serve	Full scan + dashboard only (no server)
./run --quick	Quick scan (3 categories) + dashboard + serve
./run --docker	Full scan + dashboard in Docker (publishes localhost:11777)
./scripts/run-dashboard-safe.sh	Full scan + serve with automatic port fallback/cleanup options

Or run the script directly:

./scripts/run-full-dashboard.sh              # full + serve
./scripts/run-full-dashboard.sh --no-serve   # full, no server
./scripts/run-full-dashboard.sh --quick      # quick + serve
./scripts/run-dashboard-safe.sh              # full + serve (auto fallback port when 11777 is busy)
./scripts/run-dashboard-safe.sh --kill-port  # full + serve (terminate process occupying 11777)
./scripts/run-dashboard-safe.sh --docker     # run dashboard workflow in Docker

Docker Run

The default image runs local scanner categories (code, access-control, infra, cicd, saas, etc.) and now includes kubectl + prowler CLI so -c prowler / Kubernetes scans can also run inside Docker (assuming you mount credentials/kubeconfig). For production-grade cloud/K8s scanning, prefer running on the host with --kubeconfig and AWS/GCP/Azure SSO profiles, or use a hardened custom image that adds your org-specific tooling.

# Build image once (or let wrappers auto-build)
docker build -t claudesec:local .

# Dashboard flow in Docker
./run --docker
./run --docker --no-serve
./run --docker --quick

# Scanner flow in Docker
./scripts/run-scan-docker.sh
./scripts/run-scan-docker.sh -c code
./scripts/run-scan-docker.sh -c infra
./scripts/run-scan-docker.sh -c access-control

Recommended day-to-day flow:

./scripts/run-dashboard-safe.sh --kill-port  # avoid port-conflict / stale-server issues
./run --quick                                # fast smoke check
./run --no-serve                             # final full scan artifact generation
grep -q "ClaudeSec local security scanner results" claudesec-dashboard.html

Optional Korean compliance workflow:

./scripts/setup-legal-intel.sh
./scripts/legalize-search.sh "개인정보" 개인정보보호법

Not sure where to start?

From the repo root, run ./run. The first run may take a few minutes (full scan); use ./run --quick for a faster try with 3 categories. For container-first validation, run ./run --docker --no-serve and check claudesec-dashboard.html.

---

Why ClaudeSec?

AI coding assistants accelerate development — but speed without security creates risk. ClaudeSec bridges this gap:

• Shift-left security: Catch vulnerabilities before they reach production
• AI-native guardrails: Security hooks and prompts designed for Claude Code workflows
• AI Security automation: GitHub Actions, pre-commit hooks, and CI/CD templates
• SaaS security scanning: Datadog, Cloudflare, Vercel, ArgoCD, Sentry, Okta, SendGrid, and more
• Supply chain integrity: SLSA, SBOM, and artifact signing workflows
• Compliance mapping: SOC 2, ISO 27001, NIST 800-53, PCI-DSS, CMMC 2.0 Level 2, KISA ISMS-P, KISA 주요정보통신기반시설
• Living documentation: Actionable guides for OWASP Top 10, MITRE ATLAS, and more

ISMS Asset & Security Dashboard

ClaudeSec provides an ISMS PDCA-based integrated dashboard that combines security scanning, asset management, and vulnerability assessment into a single view.

One Command — Full Asset Scan + Dashboard

# Full: security scan + asset collection + dashboard build + Docker serve
./run-all.sh

# Quick scan only (code, infra, cicd)
./run-all.sh --quick

# Include AWS infrastructure collection
./run-all.sh --aws

# Build dashboard only (skip scan)
./run-all.sh --build-only

Dashboard served at http://localhost:11777 (Docker) with 9 tabs:

Tab	Data Sources	Description
ISMS PDCA	All sources	Plan/Do/Check/Act cycle with scores
ClaudeSec Scan	Scanner	Code, infra, CI/CD, AI security checks
Security	Prowler, Datadog SIEM	Vulnerability findings, severity distribution
Asset Management	Sheets, SentinelOne, Jamf	PC/endpoint inventory, EDR cross-verification
Infrastructure	AWS, Datadog	EC2, RDS, ElastiCache, Karpenter node detection
SaaS & License	Sheets	SaaS inventory, auth method analysis, license tracking
Cost Analysis	xlsx	Monthly SaaS spending by software/department
AI Subscription	Sheets	AI service usage (Claude, GPT, Cursor, etc.)
Security Signals	Datadog SIEM, Notion	14-day alerts + security audit history

Data Collection

The dashboard aggregates data from multiple sources:

Data Sources                  Collection Method
─────────────────────────────────────────────────
Datadog API                   Hosts, SIEM signals, SentinelOne logs
Google Sheets API             Asset registry, SaaS, licenses
Google Drive API (xlsx)       SaaS cost/spending data
AWS CLI (describe)            EC2, RDS, ElastiCache, S3, EKS
Prowler (K8s Job)             CIS benchmark, security checks
Notion API                    Security audit history
ClaudeSec Scanner             Code, infra, CI/CD, AI checks

Cross-Verification

Automatically detects discrepancies between data sources:

• EC2 cross-verify: AWS live instances vs asset registry (Karpenter dynamic nodes auto-excluded)
• Endpoint cross-verify: Jamf MDM vs SentinelOne EDR (identifies devices missing protection)
• SaaS auth audit: Identifies ID/PW-only services that need SSO migration

Configuration

# Required: Google OAuth (first-time browser auth)
pip install gspread google-auth google-auth-oauthlib openpyxl

# Required: Datadog API keys in ~/Desktop/.env
# datadog_key_credential=<API_KEY>
# datadog_app_key_credential=<APP_KEY>

# Optional: AWS profiles for infrastructure collection
# Requires valid AWS CLI sessions (SSO or credentials)

# Optional: Prowler K8s CronJob (weekly scan)
kubectl apply -f .claudesec-prowler/prowler-rbac.yaml --context <dev-cluster>
kubectl apply -f .claudesec-prowler/prowler-cronjob.yaml --context <dev-cluster>

Docker

# Start dashboard (nginx, port 11777)
docker compose up -d dashboard

# Endpoints:
#   http://localhost:11777           → ISMS Dashboard
#   http://localhost:11777/scan.html → 301 to / (scan summary folded into the ISMS dashboard)

Directory Structure

claudesec/
├── run-all.sh                          # One-command: scan + build + serve
├── scripts/
│   ├── build-dashboard.py              # Dashboard data collection & HTML build
│   ├── asset-gsheet-sync.py            # Google Sheets sync
│   ├── collect-assets.sh               # Multi-source asset collector
│   ├── run-prowler-k8s.sh              # Prowler K8s scan (CronJob-based)
│   └── full-asset-sync.py              # Full sync to Google Sheets
├── claudesec-asset-dashboard.html      # Dashboard template (no data)
├── .claudesec-prowler/
│   ├── prowler-rbac.yaml               # K8s ServiceAccount + ClusterRole
│   └── prowler-cronjob.yaml            # Weekly Prowler CronJob
├── scanner/                            # ClaudeSec security scanner
├── docker-compose.yml                  # Docker stack
└── Dockerfile.nginx                    # Dashboard serving

Privacy: All scan results, asset data, and dashboard files with real data are in .gitignore. Only templates and scripts are committed. No PII, company info, or credentials are included in the repository.

---

Scanner CLI

ClaudeSec includes a zero-dependency bash scanner that checks your project for security best practices across 11 categories (201 checks). The prowler category integrates with Prowler for deep multi-cloud scanning.

Scanner anchors

• Quick Start
• CI Templates
• OAuth and Token Policy
• SaaS Live Scan

Scanner Quick Start

# From repo root
./scripts/run-scan.sh
./scripts/run-scan.sh --docker

# Direct CLI
./scanner/claudesec scan -d .
./scanner/claudesec scan --category cloud
./scanner/claudesec scan --severity high,critical
./scanner/claudesec scan --format json

Scanner CI Templates

# Prowler deep scan (requires prowler)
./scanner/claudesec scan -c prowler --aws-profile audit

# AWS SSO all profiles
./scanner/claudesec scan -c prowler --aws-sso-all
AWS_SSO_LOGIN_TIMEOUT=20 CLAUDESEC_CI=1 CI=true ./scanner/claudesec scan -c prowler --aws-sso-all -f json

# Strict SSO mode for templates/prowler.yml
# vars.CLAUDESEC_STRICT_SSO=1

# Token-expiry gate vars for templates/prowler.yml / templates/security-scan-suite.yml
# vars.GH_TOKEN_EXPIRES_AT=2026-03-20T09:00:00Z
# vars.OKTA_OAUTH_TOKEN_EXPIRES_AT=2026-03-20T09:00:00Z
# vars.CLAUDESEC_TOKEN_EXPIRY_GATE_MODE=24h
# vars.CLAUDESEC_TOKEN_EXPIRY_PROVIDERS=github,okta,datadog,slack
# vars.CLAUDESEC_TOKEN_EXPIRY_STRICT_PROVIDERS=true
# vars.CLAUDESEC_DD_ARTIFACT_RETENTION_DAYS=30   # valid range: 1-90

Reusable workflow components:

• .github/actions/token-expiry-gate
• .github/actions/datadog-ci-collect

Scanner OAuth and Token Policy

Okta recommends scoped OAuth 2.0 access tokens over SSWS API tokens for automation.

• Preferred: OKTA_OAUTH_TOKEN
• Fallback: OKTA_API_TOKEN
• Strict scope check: CLAUDESEC_STRICT_OKTA_SCOPES=1
• Required scopes override: CLAUDESEC_OKTA_REQUIRED_SCOPES

export OKTA_ORG_URL="https://dev-123456.okta.com"
export OKTA_OAUTH_TOKEN="<okta-oauth-access-token>"
export GH_TOKEN="<github-token>"
export CLAUDESEC_OKTA_REQUIRED_SCOPES="okta.users.read,okta.policies.read,okta.logs.read"
export CLAUDESEC_STRICT_OKTA_SCOPES=1
./scanner/claudesec scan -c saas

Scanner SaaS Live Scan

# SaaS API scan
./scanner/claudesec scan -c saas

# Dashboard with token expiry windows
export OKTA_OAUTH_TOKEN_EXPIRES_AT="2026-03-13T09:00:00Z"
export GH_TOKEN_EXPIRES_AT="2026-03-13T08:30:00Z"
export CLAUDESEC_TOKEN_EXPIRY_WARNING_24H="24h"
export CLAUDESEC_TOKEN_EXPIRY_WARNING_7D="7d"
./scanner/claudesec dashboard --serve --host 127.0.0.1 --port 11665

# Optional: populate OAuth readiness cards via ~/.claudesec.env (auto-loaded)
cat > ~/.claudesec.env <<'EOF'
GH_TOKEN=<github-token>
GITHUB_TOKEN_EXPIRES_AT=2026-03-20T09:00:00Z
OKTA_OAUTH_TOKEN=<okta-oauth-token>
OKTA_OAUTH_TOKEN_EXPIRES_AT=2026-03-20T09:00:00Z
EOF
./run --no-serve

# Datadog local auto-fetch
DD_API_KEY=<your-dd-api-key> DD_APP_KEY=<your-dd-app-key> DD_SITE=datadoghq.com ./scanner/claudesec dashboard

Secrets noise reduction (allowlist vs real risk)

SECRETS-002 (.env) and SECRETS-004 (credential-path references) are split by path risk:

• Non-allowlisted paths (for example src/, app runtime code): FAIL (real risk)
• Allowlisted sample paths (templates/, examples/, docs/, scanner/tests/): WARN (operationally allowed)

Optional custom allowlist regex:

export CLAUDESEC_SECRETS_ALLOWLIST_REGEX='^playbooks/|^internal-samples/'
./scanner/claudesec scan -c access-control

CI reproducibility check (dashboard regression gate)

Use a deterministic check in CI to catch dashboard generation regressions:

./scripts/run-dashboard-docker.sh --quick --no-serve --build
./scripts/run-dashboard-docker.sh --no-serve
test -f claudesec-dashboard.html
grep -q "ClaudeSec local security scanner results" claudesec-dashboard.html

Advanced scanner examples (AWS SSO role troubleshooting, kubeconfig/prowler, Microsoft source filter, Datadog troubleshooting) are kept in:

• docs/guides/getting-started.md
• docs/guides/workflow-components.md
• docs/guides/saas-best-practices-scans.md

Datadog Required Tag Contract

Use these required tags across CI workflow templates when querying/sending Datadog logs:

• service:<workflow-service-name> (example: service:prowler)
• env:ci
• ci_pipeline_id:${{ github.run_id }}

Contract query format:

service:${DD_SERVICE} env:${DD_ENV} ci_pipeline_id:${CI_PIPELINE_ID}

Datadog ingest contract (CI log intake):

POST /v1/input?ddtags=service:${DD_SERVICE},env:${DD_ENV},ci_pipeline_id:${CI_PIPELINE_ID}

Recommended reusable env keys in workflow templates:

env:
  DD_SERVICE: <workflow-service-name>
  DD_ENV: ci
  CI_PIPELINE_ID: ${{ github.run_id }}

네트워크·보안 툴 (Network & security tools)
The dashboard includes a 네트워크·보안 툴 tab when you run the network category. It aggregates:

• Trivy — vulnerability and misconfiguration scan (filesystem + config); results in .claudesec-network/ and in the dashboard.
• Nmap / SSLScan — optional; enable in .claudesec.yml with network_scan_enabled: true and network_scan_targets: "host:443" (only scan hosts you are authorized to scan).

See templates/claudesec-network.example.yml for config. Trivy runs by default when installed; Nmap/SSLScan run only when explicitly enabled and targets are set.

Scanner Categories

Category	Checks	Covers
infra	18	Docker, Kubernetes, IaC (Terraform/Helm)
ai	9	LLM API keys, prompt injection, RAG, agent tools
network	10	TLS, security headers, CORS, firewall rules; Trivy (vuln/misconfig), optional Nmap/SSLScan → dashboard tab
cloud	13	AWS, GCP, Azure (IAM, logging, storage, network)
access-control	10	.env files, password hashing, JWT, sessions
cicd	11	GHA permissions, SHA pinning, SAST, lockfiles; run-history freshness (deploy liveness, scan staleness, zero-alert evidence)
code	24	SQL/Command/XSS injection, SSRF, XXE, crypto, deserialization, SAST tools
macos	20	FileVault, SIP, Gatekeeper, CIS Benchmark v4.0
windows	20	KISA W-series, UAC, Firewall, Defender, SMBv1
saas	49	SaaS API scanning (GitHub, Datadog, Cloudflare, Vercel, Sentry, Okta, SendGrid, Slack, PagerDuty, Jira, Grafana, New Relic, Splunk, Twilio, MongoDB Atlas, Elastic Cloud)
prowler	16 providers	Deep scan via Prowler: AWS, Azure, GCP, K8s, GitHub, M365, Google Workspace, Cloudflare, MongoDB Atlas, Oracle Cloud, Alibaba Cloud, OpenStack, NHN, IaC, LLM, Image

Project Structure

claudesec/
├── assets/              # Logo and branding (see BRANDING.md)
├── scanner/             # Security scanner CLI (bash, zero dependencies)
│   ├── claudesec        # Main CLI entry point
│   ├── lib/             # Output formatting, helper functions
│   └── checks/          # Check modules (infra, ai, network, cloud, cicd, access-control, macos, windows, saas, prowler)
├── docs/
│   ├── devsecops/       # DevSecOps practices, OWASP, supply chain, cloud, K8s
│   ├── github/          # GitHub security features and workflows
│   ├── ai/              # AI/LLM security, MITRE ATLAS, prompt injection
│   ├── compliance/      # NIST CSF 2.0, ISO 27001/42001, KISA ISMS-P
│   ├── architecture/   # Draw.io diagrams (scanner, flow, security domains)
│   └── guides/          # Getting started, compliance mapping, branding
├── templates/           # GitHub Actions workflow templates, example configs
├── scripts/             # Security automation scripts (run, setup, run-full-dashboard)
├── hooks/               # Claude Code security hooks
├── examples/            # Example configurations
└── .github/             # Issue templates, CI workflows

Documentation

• Branding — Logo and visual identity (docs/branding.md)

DevSecOps

Guide	Description
OWASP Top 10 2025	All 10 categories with controls and code examples
Supply Chain Security	SLSA, SBOM, Sigstore, OpenSSF Scorecard
Cloud Security Posture	CSPM with Prowler, multi-cloud checklist
Kubernetes Security	Pod security, RBAC, NetworkPolicy, runtime
DevSecOps Pipeline	End-to-end secure CI/CD pipeline
Audit Checklist	80+ audit points for CI/CD, DB, server, K8s
Security Maturity (SAMM)	OWASP SAMM assessment and roadmap
Threat Modeling	AI-assisted STRIDE threat modeling
Security Champions	Building security culture at scale
macOS CIS Security	CIS Benchmark v4.0 hardening guide

AI Security

Guide	Description
OWASP LLM Top 10 2025	LLM-specific risks including agentic AI
MITRE ATLAS	AI threat framework with 66 techniques
Prompt Injection Defense	Multi-layer defense strategies
AI Code Review	OWASP-aligned AI-assisted security review
LLM Security Checklist	Pre-deployment security checklist

GitHub Security

Guide	Description
GitHub Security Features	Dependabot, CodeQL, secret scanning
Branch Protection	Rulesets, CODEOWNERS, environment protection
Actions Security	Supply chain hardening for CI/CD
CI Operations Playbook	CodeQL default setup policy, docs prechecks, 401 retry, Dependabot conflict handling

Compliance

Guide	Description
NIST CSF 2.0	6 functions including new Govern, SP 800-53 control families
ISO 27001:2022	93 controls in 4 themes, 11 new controls
ISO 42001:2023	AI Management System (AIMS) with Annex A controls
KISA ISMS-P	102 certification items for Korean compliance
KISA 주요정보통신기반시설	Windows W-01W-84, Unix U-01U-72, PC-01~PC-19 (175 items)

Guides

Guide	Description
Getting Started	Quick setup guide
Shell Lint Policy	Fixed ShellCheck scope, severity, and options policy for local and CI
Compliance Mapping	SOC 2, ISO 27001, NIST 800-53, PCI-DSS, CMMC 2.0 Level 2, KISA ISMS-P
Workflow Components	Reusable composite actions and template integration contract
Hourly Operations	Hourly cron automation with OpenCode pull and continuous improvement loop
Compliance Scan Priority	Prowler, Lynis, tool priorities and frameworks
Claude Lead Agents	Multi-agent roles and handoff format
Legal Intelligence Setup	legalize-kr local mirror + GitHub Repo MCP for Korean compliance workflows
Branding	Logo, colors, visual identity, SNS link-share preview (KakaoTalk/FB/Slack/X)

Link sharing & SNS preview verification

Open Graph/Twitter meta priority, image requirements per platform, and cache-invalidation procedure live in docs/branding.md § SNS 링크 공유 미리보기. Quick contributor checks before sharing a new URL externally:

# 1. og:image reachable + correct content-type
curl -sI https://twodragon0.github.io/claudesec/assets/claudesec-logo.png \
  | grep -E '^(HTTP|content-type)'

# 2. Inspect deployed OG/Twitter meta
curl -s https://twodragon0.github.io/claudesec/ \
  | grep -E '(og:|twitter:)' | head -20

# 3. Force-refresh platform caches (manual UI step)
#    KakaoTalk : https://developers.kakao.com/tool/debugger/sharing  → URL → 초기화
#    Facebook  : https://developers.facebook.com/tools/debug/         → URL → Scrape Again
#                (Slack and LinkedIn defer to Facebook's OG cache)

Templates

Ready-to-use GitHub Actions workflows:

Template	Purpose
codeql.yml	CodeQL static analysis
dependency-review.yml	Block PRs with vulnerable deps
prowler.yml	Cloud security posture scan
security-scan-suite.yml	CodeQL + Semgrep + Trivy + Gitleaks + OSV-Scanner (SARIF → Code scanning)
sbom.yml	SBOM generation + vulnerability scan + signing
scorecard.yml	OpenSSF Scorecard health check
SECURITY.md	Security policy template
dependabot.yml	Dependabot configuration

Reusable Workflow Components

Component	Path	Used by
Token Expiry Gate	.github/actions/token-expiry-gate	templates/prowler.yml, templates/security-scan-suite.yml
Datadog CI Collect	.github/actions/datadog-ci-collect	templates/prowler.yml, templates/security-scan-suite.yml

Hooks

Claude Code security hooks for real-time protection:

Hook	Trigger	Purpose
security-lint.sh	PreToolUse (Write/Edit)	Blocks hardcoded secrets, injection patterns
secret-check.sh	Pre-commit	Prevents committing secrets

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Write|Edit",
        "hooks": [
          { "type": "command", "command": "bash hooks/security-lint.sh" }
        ]
      }
    ]
  }
}

See hooks/README.md for details.

ISMS Compliance Mapping

ClaudeSec scanner checks are mapped to major compliance frameworks. Each finding includes a compliance reference for audit evidence.

ClaudeSec Category	NIST CSF 2.0	ISO 27001:2022	KISA ISMS-P	SOC 2
Code (SAST)	DE.CM, PR.DS	A.8.4, A.8.28	2.9, 2.11	CC6.1, CC7.1
CI/CD	PR.DS, PR.PS	A.8.9, A.8.25	2.9, 2.10	CC6.6, CC8.1
Access Control	PR.AC, PR.AA	A.5.15, A.8.5	2.5, 2.6	CC6.1, CC6.3
Infrastructure	PR.IP, PR.PT	A.8.9, A.8.25	2.10	CC6.6, CC7.1
Cloud	ID.AM, PR.AC	A.5.23, A.8.26	2.8, 2.10	CC6.6, CC6.7
Network	PR.DS, DE.CM	A.8.20, A.8.21	2.10	CC6.6
AI/LLM	GV.OC, ID.RA	A.5.8 (new)	2.9	CC6.1, CC7.2
SaaS	ID.AM, PR.AC	A.5.23, A.8.26	2.5, 2.10	CC6.1, CC6.6
macOS/Windows	PR.IP, PR.PT	A.8.1, A.8.9	2.10	CC6.6, CC6.8
Prowler	Full coverage	A.8, A.5	2.5~2.11	CC6, CC7, CC8

Full mapping details: docs/guides/compliance-mapping.md

Supported Frameworks

Framework	Version	Controls	Coverage
NIST CSF	2.0	6 Functions (GV, ID, PR, DE, RS, RC)	120+ checks mapped
ISO 27001	2022	93 controls (4 themes)	Full Annex A mapping
ISO 42001	2023	AI Management System	AI category checks
KISA ISMS-P	v3.0	102 certification items	Korean compliance
SOC 2	Type II	Trust Services Criteria	CC1~CC9 mapped
CIS Benchmarks	v4.0	macOS, Windows, K8s	OS hardening checks
OWASP	Top 10 2025	10 categories	Code + AI checks
OWASP LLM	Top 10 2025	10 LLM risks	AI category

Frameworks Scored in the Compliance Report

The table above lists the frameworks ClaudeSec has checks and guides for. It is deliberately wider than the set the compliance report scores: OWASP Top 10 is a check category, not a control catalogue. The scored set is COMPLIANCE_CONTROL_MAP in scanner/lib/compliance-map.py, and these are its framework keys verbatim — the same strings the dashboard renders:

Framework (COMPLIANCE_CONTROL_MAP key)	Controls	N/A	Scored
ISO 27001:2022	7	1	6
KISA ISMS-P	44	15	29
KISA ISMS Simple	20	6	14
PCI-DSS v4.0.1	7	0	7
NIST 800-53 Rev5	10	0	10
CIS Benchmarks	9	1	8
SOC 2 (TSC)	9	3	6
CMMC 2.0 Level 2	14	0	14

N/A counts controls carrying assessable: False — organisational requirements no automated check can evidence, rendered N/A rather than FAIL. Eleven of ISMS-P's fifteen are its 3.x privacy controls. Scored is therefore the denominator of that framework's compliance percentage; a total taken from the published standard (ISO 27001's 93, CMMC's 110) is a different population and will not reconcile.

These counts are pinned by scanner/tests/test_ci_compliance_framework_sync.py, which fails if a framework is added to the map without appearing here.

Security Coverage Map

                    ClaudeSec Coverage
┌──────────────────────────────────────────────────┐
│  PLAN          BUILD          TEST         DEPLOY │
│  ┌──────┐     ┌──────┐     ┌──────┐     ┌──────┐│
│  │Threat│     │Secret│     │SAST  │     │CSPM  ││
│  │Model │     │Scan  │     │DAST  │     │IaC   ││
│  │Design│     │SCA   │     │Pentest│    │K8s   ││
│  │Review│     │SBOM  │     │Fuzz  │     │Cloud ││
│  └──────┘     └──────┘     └──────┘     └──────┘│
│                                                   │
│  MONITOR       COMPLY        AI SAFETY            │
│  ┌──────┐     ┌──────┐     ┌──────┐              │
│  │Audit │     │SOC2  │     │LLM   │              │
│  │Alert │     │ISO   │     │ATLAS │              │
│  │SIEM  │     │NIST  │     │Agent │              │
│  │IR    │     │PCI   │     │RAG   │              │
│  └──────┘     └──────┘     └──────┘              │
└──────────────────────────────────────────────────┘

Contributing

We welcome contributions! See CONTRIBUTING.md for guidelines.

Areas We Need Help

• Language-specific security guides (Python, Go, Rust, Java)
• Additional CI/CD integrations (GitLab CI, Azure DevOps)
• Real-world case studies and incident post-mortems
• Translations (i18n) — especially Korean, Japanese, Chinese
• Custom CodeQL queries and Semgrep rules
• Kubernetes admission policies (Kyverno/OPA)

Acknowledgments

• Cloud security patterns from prowler-cloud/prowler
• Audit framework informed by querypie/audit-points
• Web security based on OWASP Top 10 2025
• AI security guidance from MITRE ATLAS and OWASP LLM Top 10
• Built for the Claude Code ecosystem

Support this project

If ClaudeSec helps your DevSecOps or AI-assisted security workflow, consider giving it a star on GitHub — it helps others discover the project.

Star History

License

MIT License — see LICENSE for details.