How to use Claude to audit backend security

Thomas Hansen asked Claude Code to review Magic Cloud's actual backend source for security weaknesses. The scope included Kestrel host settings, system endpoints and plugin projects covering authentication, file operations, SQL evaluation, diagnostics, cryptography and execution.

The agent surfaced contradictory or excessive request-body limits and long keep-alive and request-header timeouts. Hansen also reports a path-traversal weakness in RootResolver's AbsolutePath handling and debug output in PythonExecute that exposed internal paths. He says he corrected these findings after reviewing them.

The account includes an unresolved issue instead of presenting a clean bill of health. TerminalExecute lacked a timeout, so a runaway process could block until someone intervened. Similar concerns applied to some Git operations. Hansen explained that these paths were restricted to root users, which affected how he assessed their severity without removing the need for a fix.

The useful result is a set of source-specific hardening changes and a documented remaining item. Hansen also reports favorable agent conclusions about other subsystems, but those do not establish that vulnerabilities were absent. This is a maintainer's account of an AI-assisted review of his own product, with its conclusions requiring that attribution.

Prompt
Suggested prompt (written by Agents In Use, not the author's)

Source: Blog · Thomas Hansen