[BUG] Analyze source code security and performance issues, Claude output is incomplete

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When I scanned the code using Claude, I found security and performance issues. The Claude output looked incomplete.

package main

import (
	"fmt"
	"os/exec"
)

func main() {
	cmd := exec.Command("claude", "-p", propmt)
	bytes, _ := cmd.CombinedOutput()
	fmt.Println(string(bytes))
}

var propmt = `
You are a senior Golang security/performance/code audit expert. Please help me scan and analyze a GitHub repository/local project’s Go code.

【Scope & Exclusion Rules】

Only scan files with the .go suffix.

Exclude files ending with _test.go.

Exclude all .go files under the cmd/ directory.

【Exclusion Rules: Do NOT report as issues in the following cases】

Tokens/secrets in logs: As long as they are not hardcoded (e.g., come from config files or environment variables), do not report.

Concurrency safety: If the variable is a local variable inside a function, do not report.

Missing database transaction timeout control: Do not report just because ctx is missing.

Business hardcoded strings, fixed IDs, weak random numbers: do not report.

Business idioms such as err = json.Unmarshal(bytes, scale): do not report.

Normal configs like config.yaml are not considered hardcoded leaks, do not report.

【Tasks to Complete】

Analyze the project for severe performance issues, security issues, and critical vulnerabilities, and list all findings (sorted by importance).

For each finding, provide both the vulnerable code snippet (before fix) and the corrected code snippet (after fix).

【Risk Level Classification】

🔴 High Risk: Could lead to remote code execution, severe privilege bypass, sensitive data leaks, major financial/data loss, or widely exploitable vulnerabilities.

🟡 Medium Risk: Could lead to privilege escalation, limited information disclosure, performance degradation affecting availability, or moderate-probability bugs.

🟢 Low Risk: Affects only code maintainability, edge-case occasional errors, or low-impact performance issues.

【Output Format Requirements】
List items sequentially. Each item must include the following fields (field names must be exact):

{Index}. {Short Title}

Type: {Security Vulnerability OR Performance Issue}
Level: {🔴 High Risk / 🟡 Medium Risk / 🟢 Low Risk}

Location: {file path:line number}

Problem: {One-sentence summary of the issue essence}

Risk: {Risk description}

Before Fix:

// problematic Go code


After Fix:

// corrected Go code
`

Output results, only the Summary

## Summary

The audit identified **8 security and performance issues** across the PDF generator service:

- **🔴 3 High Risk**: SQL injection potential, nil pointer dereference, and unsafe HTTP client
- **🟡 4 Medium Risk**: Path traversal, hardcoded secrets, memory leaks, and template injection
- **🟢 1 Low Risk**: Minor performance optimization

The most critical issues are the nil pointer dereference in `model.go:33` and the unsafe HTTP client usage in `model.go:240`, which should be addressed immediately to prevent potential security exploits and service disruptions.

What Should Happen?

This doesn't happen when I use interactive mode.

<img width="3821" height="2116" alt="Image" src="https://github.com/user-attachments/assets/ff2e00e9-7b7e-4172-808b-32face569e15" />

Error Messages/Logs

Steps to Reproduce

1.Open Terminal
2.Run

claude -p "propmt"

Claude Model

us.anthropic.claude-opus-4-1-20250805-v1:0

Is this a regression?

No

Last Working Version

_No response_

Claude Code Version

1.0.127

Platform

AWS Bedrock

Operating System

Other Linux

Terminal/Shell

Other

Additional Information

_No response_