Developer Builds Security Hook That Forces Claude Code to Fix Vulnerabilities Before Finishing

A developer discovered that Claude Code, after being asked to add an AI chat feature, produced working code that also contained hardcoded API keys, unsafe innerHTML rendering, and eval() calls before declaring the task complete. To address this, the developer built a verification loop using Claude Code's Stop hook, which intercepts Claude's completion signal and scans only the changed lines of code for five common AI-generated security mistakes. If any issues are found, the hook returns an exit code 2 along with a detailed report, forcing Claude to revise the code before it can finish. After a maximum of three failed attempts, the hook stops blocking and instead writes a security report for a human reviewer, preventing infinite loops. The project is shared as a drop-in configuration folder containing the hook, settings, and a skill file that instructs Claude on how to properly remediate each flagged issue.