AI Blocks › Keep your code secure
Fix your API's security gaps and send a pull request a reviewer can trust
Give it your API code. Get gaps fixed, tests for each fix and a reviewed pull request.
Fix API security gaps with tests and a pull request is a free AI workflow for the job "Keep your code secure". It guides your AI through several skills in order, passing each step's output to the next.
Free · No account · Made by AI Blocks · Level: advanced · Thinking: high
What it does
A security scan hands you a list. Turning that list into a merged fix is the hard part. Fixes go in without tests, so the next edit quietly undoes them. Nobody reviews the fixes for new harm. The pull request says "security fixes" and the reviewer has to guess what changed. The steps close that gap. First it checks every route for sign-in, access and input gaps and writes a fix for each. Next it reads those fixes and lists every new behaviour that no test would catch, with the test to add. Then you add the tests and run your suite. After that it reviews the finished change, fixes and tests together, for breakage and new risk. Last it writes the pull request, with the gaps as the story.
You give it
- Your API code (a folder or repo the AI can open)
- Your test folder, so it can see what is already covered
- Who your callers are and how they sign in (optional)
You get
- A ranked list of sign-in, access and input gaps, with a fix written for each
- A list of the new behaviours no test covers, with test cases to add
- A review of the finished change, ranked by how serious each issue is
- A pull request description with before and after proof and a note on what else could break
Use it when
- A scan or audit found gaps in your API and you need to merge fixes this week.
- You added routes fast and never checked who may call them.
- You want the fixes to stay fixed, with tests that fail if someone removes them.
Steps
- API security checker: Point it at your API routes. Get a check of sign-in, access rules and input, with fixes for each gap.
- Code change test coverage review: Give it a code change and your tests. Get each new behaviour marked covered or not, plus test cases for the gaps.
- Pull request risk reviewer: Give it a pull request. Get issues ranked by severity, security notes and clear review comments.
- Pull request writer: Give it your changes. Get a clear pull request description a reviewer can follow.
How to use it
- Download the handoff pack. It's a zip with HANDOFF.md and every skill file this workflow uses.
- Give the folder to Claude (in Claude Code, or as files in a Claude Project) and say "Follow HANDOFF.md".
- Point it at the API folder and the tests. Use a test copy, not production data.
- After step 2, add the tests and run your suite before you continue.