◇ Could this help me?
Yes. These are standard, genuinely safe defensive security checks run against your own app (secrets scanning, authentication bypass testing, and basic SQL-injection probing), and they target the exact failure modes AI-generated code is known for while trusting verification over the agent's own "it's fine". This is project-specific practice to repeat for every app that ships rather than a general Claude Code configuration change, though it pairs well with a reusable pre-ship checklist prompt.
Run a pre-ship security review of this codebase using three checks. 1: Search the entire codebase for any API key, token, password, or other secret that is not stored in an environment variable, and list every finding with its file and line. 2: Enumerate every page, route, and API endpoint, then test which of them can be reached without being logged in, and flag any that expose data or actions to unauthenticated users. 3: Test every input field and query parameter for SQL injection, starting with a single quote character, and flag any errors or unexpected behavior. Report all findings ranked by severity with a suggested fix for each, and do not change any code until the fixes are explicitly approved.