Claude Code just shipped a built-in security-guidance plugin — a 3-layer review that runs a pattern check, a model review, and a commit check before code lands. It's a real upgrade. But here's the catch: generic security review doesn't know your project.

It doesn't know which fields are nullable. It doesn't know that one of your APIs is...