One request, the whole assessment

acme-shop is a small synthetic project bundled with PenSec: an Express API with Stripe webhooks, a Python helper that calls an LLM, a GitHub Actions workflow, a Dockerfile, Terraform and an Android manifest. In Claude Code you ask once. Claude runs the assessment, asks one question, applies the fix you choose with a retest, and later retests its own edits without being asked.

Replay in Claude Code

Every command output and the hook message are produced by the real PenSec build on this fixture in CI. The short user and Claude messages are written for the demo. Pick a step or let it play.

claude · ~/acme-shop

Findings explorer

Confirmed observations and suspected signals from the assessment in the replay, read from its JSON report.

Open the full HTML report JSON

Try it on your code

In Claude Code

/plugin marketplace add ratomirjovanovic/pensec
/plugin install pensec@pensec          # macOS, Linux
/plugin install pensec-windows@pensec  # Windows

# restart Claude Code, then in your project:
Check the security of this project.

CLI

cd your-project
pensec assess

Install with Homebrew, Scoop, a release binary or go install; see the installation guide.