Claude Code Security
An independent scan of 630 lines Claude Opus wrote reported 31 security findings, 6 of them critical. What Claude Code Security covers, where agent review structurally stops, and what a second opinion adds.
Primary question: Is Claude Code Security enough on its own, or does agent-written code still need independent static analysis?
Direct answer
What Claude Code Security covers, and where an independent scan adds evidence
Claude Code Security is Anthropic's security review for Claude Code — the /security-review command, a repository and pull request scanning plugin, a GitHub Action, and Claude Security for repository-wide scans on Enterprise plans. It reasons over code context instead of matching fixed rules, and it finds real defects. What it is not is a second opinion, because the review comes from the same model family that wrote the code, and it produces a session result rather than a reproducible record a release gate can read. [anthropic-claude-code-docs][anthropic-claude-security][anthropic-defenders]
Independent static analysis answers the part agentic review structurally cannot. It produces the same finding set on every run of the same commit, it covers dependencies and binaries the agent never had in context, and it leaves a scan record that can be compared release over release. The two are complementary — the in-session review fixes what it can before the change lands, the independent scan produces the evidence the release decision rests on. [derscanner-sast]
The gap is measurable. In one independent scan of 630 lines of JavaScript written by Claude Opus, a scanner with no part in generating that code reported 31 security findings — 6 critical, 24 medium, 1 low — at a security score of 16 out of 100, alongside 700 code quality findings of which 431 were critical. After remediation and a rescan of the same project, security findings fell to 5 at a score of 65, and critical quality findings went to zero. [claude-opus-javascript-scan]
Definitions
Claude Code Security
Anthropic's security review capability for Claude Code — the /security-review command inside a terminal session, a plugin that scans repositories and pull request diffs, a GitHub Action for pull requests, and Claude Security for repository-wide scans on Enterprise plans.
/security-review
The slash command that reviews pending changes inside a Claude Code session and proposes patches the developer reviews and approves manually.
Agentic security review
Review performed by a model reasoning over code context and business logic rather than matching fixed analysis rules. Coverage depends on the model and the session, and results can differ between runs on the same input.
Second-opinion SAST
Static analysis performed by a tool that had no part in generating the code, producing a finding set that is reproducible across runs and independent of the agent that wrote it.
The engineering problem
Teams treat the in-session review as the security gate because it runs where the code is written and costs nothing extra to invoke.
Agentic review results can differ between runs on the same input, so there is no stable artifact to compare one release against the next.
The agent reviews the source in front of it. Dependencies it pulled in and binaries it never sees stay outside that scope. [claude-opus-fastapi-sca]
Injection that is reachable on the running service is accepted as theoretical when nobody exercises the deployed application. [dast-sast-correlation]
The volume of agent-written code outpaces a review capacity that was sized for hand-written changes.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Agentic security review
Agent-native review- Artifact
- Findings and suggested patches produced by Claude inside the session or the pull request, through /security-review, the scanning plugin, the GitHub Action, or Claude Security.
- Risk
- The review originates from the same model family that wrote the code, and coverage varies between runs.
- Output
- A reviewed diff with proposed fixes that the developer approves manually.
Evidence: Claude Code security documentationClaude Security — scan your codebase for vulnerabilities
Independent static analysis
Second opinion SAST- Artifact
- The same codebase analysed by a scanner that did not generate it, across source and supported binary formats.
- Risk
- Defects in agent-written code go unrecorded because the only review lived inside the agent session.
- Output
- Findings with code context, data flow, and severity, reproducible on the same commit and comparable across scans.
Evidence: DerScanner SAST documentationIndependent scan of 630 lines written by Claude Opus
Dependency analysis with reachability
SCA with reachability- Artifact
- Direct and transitive dependencies the agent introduced, resolved against known vulnerabilities and checked for reachability from application code.
- Risk
- The agent adds packages it does not audit, and a vulnerable transitive dependency never appears in the session review.
- Output
- A vulnerable dependency list with reachability evidence separating exploitable paths from inert ones.
Evidence: SAST and hybrid SCA on a Claude Opus FastAPI application
Runtime confirmation
DAST with SAST correlation- Artifact
- The deployed application tested from the outside, with confirmed findings correlated back to the static result that predicted them.
- Risk
- Static findings stay theoretical, and nothing distinguishes a reachable injection from an unreachable one.
- Output
- Runtime-confirmed findings tied to the code path that produced them.
Evidence: Runtime DAST with SAST correlation on AI-generated code
Verification workflow
- Claude Code writes or modifies the code.
- Claude Code Security reviews the pending change in session and proposes patches; the developer reviews and approves them.
- An independent scanner analyses the merged result — source, dependencies, and supported binaries — without knowledge of how the code was produced.
- Dependencies the agent introduced are resolved and checked for reachability from application code.
- Findings that matter at runtime are confirmed against the deployed application and correlated back to the static result.
- The reproducible scan record, not the session transcript, is what the release gate reads.
- The cycle repeats on the next agent change.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner analyses code regardless of how it was produced, including code written by Claude Code, across source and supported binary formats. Because it takes no part in generating the code, its finding set is independent of the agent under review, and DerTriage evaluates those findings in context and can assign statuses when configured.
DerScanner performs static analysis of supported source and binary formats and provides DerTriage, which evaluates findings in context and can assign statuses when configured. [derscanner-sast]
Limits of verification
- Static analysis does not observe runtime behaviour. Some defects in agent-written code appear only under dynamic testing or manual review.
- Agentic review and static analysis answer different questions, so raw finding counts from the two are not directly comparable.
- We have not published a head-to-head run of Claude Code Security against an independent scan of the same repository. The measurements cited here describe independent scans of Claude-generated code, not a comparison of the two review methods.
- Reviewing agent-written code requires the same expertise and effort as reviewing code written by hand.
Common questions
Can Claude Code find security vulnerabilities?
Yes. It reasons over code context and business logic rather than matching fixed rules, and Anthropic documents coverage of injection, path traversal, authentication bypass, and insecure deserialization, with suggested patches the developer approves. What it does not produce is the same finding set on every run of the same commit, which is what a release gate needs to compare one build against the next.
Is Claude Code a security risk?
The agent is not the risk. Unreviewed output is. Code an agent writes carries the same vulnerability classes as code written by hand, and it arrives faster than a review process sized for hand-written changes can absorb. The exposure comes from treating generated code as reviewed because a model looked at it.
Is Claude Code Security enough on its own?
It is enough to catch defects early and cheaply, and not enough to be the evidence a release decision rests on. The review comes from the same model family that produced the code, its coverage varies between runs, and it leaves a session result rather than a comparable scan record. Dependencies the agent introduced and binaries it never saw stay outside its scope entirely.
How do you run Claude Code Security?
Four ways, per Anthropic's documentation. The /security-review command reviews pending changes inside a terminal session, a plugin scans repositories and pull request diffs, a GitHub Action reviews pull requests automatically, and Claude Security runs repository-wide scans on Enterprise plans.
What does an independent scan of Claude-generated code actually find?
In one measured example, 630 lines of JavaScript written by Claude Opus were scanned by a tool that took no part in generating them. The baseline reported 31 security findings — 6 critical, 24 medium, 1 low — at a security score of 16 out of 100, alongside 700 code quality findings with 431 critical. One remediation pass and a rescan brought security findings to 5 at a score of 65 and cleared every critical quality finding.
Does an independent scan replace the agent's security review?
No. They do different jobs. The in-session review fixes what it can before the change lands, which is where it is cheapest to fix. The independent scan produces a reproducible record across source, dependencies, and supported binaries, which is what an auditor, a customer, or a release gate can actually read.
Step-by-step guides
Claude Code Security Review and Code Quality — Claude Opus Wrote It, We Scanned It
Guide — the 630-line scan behind the numbers on this page, with remediation and rescan
Claude Opus Wrote the App and the Dependencies — SAST and SCA Caught Both
Guide — independent SAST and hybrid SCA on Claude Opus FastAPI with dependency reachability
Claude Code Security Wasn't Enough — DAST Found SQL Injection, SAST Correlation Confirmed It
Guide — runtime DAST on a live API, then SAST correlation with D tags
Cursor Wrote the App, DerTriage Confirmed Three Real Bugs
Guide — selective DerTriage on FastAPI injection findings after SAST
Cursor Security and Code Quality — One Prompt, 19 Findings, One Rescan
Guide — the same scan-and-rescan workflow on AI-generated TypeScript
Related knowledge
Security Review of AI-Generated Code
The broader context of reviewing AI-generated code for security
Relationship: related-toIndependent Security Validation for AI Code
Why separate analysis carries evidence the generating agent cannot provide
Relationship: related-toCursor Code Security
The same question for another AI coding agent
Relationship: related-toGitHub Copilot Code Security
Security considerations for GitHub Copilot
Relationship: related-toSecurity Validation for Coding Agents
The broader approach to securing AI-assisted development
Relationship: related-toSAST vs Code Review
The same division of labour without an agent — what automated analysis examines and what human judgment adds
Relationship: related-toCanonical terms used: Claude Code Security; /security-review; Claude Security; agentic security review; second opinion SAST; Claude Code security review.
Evidence and references
- Claude Code security documentationAnthropic documents the security model for Claude Code sessions and the /security-review command for reviewing pending changes.
anthropic-claude-code-docs - Claude Security — scan your codebase for vulnerabilitiesAnthropic documents repository and pull request scanning with Claude Security, including the plugin and GitHub Action paths.
anthropic-claude-security - Making frontier cybersecurity capabilities available to defenders — AnthropicAnthropic's announcement describes how Claude Code Security works, which finding types it targets, and where it is available.
anthropic-defenders - DerScanner SAST documentationDerScanner performs static analysis of supported source and binary formats, provides configuration-file analysis, and reports and compares analysis results. DerTriage and DerCodeFix are available within static analysis.
derscanner-sast - Independent scan of 630 lines written by Claude OpusA baseline scan reported 31 security findings — 6 critical, 24 medium, 1 low — at a security score of 16 out of 100, plus 700 code quality findings with 431 critical at a CQ score of 1. After remediation and rescan, security findings fell to 5 at a score of 65 and critical quality findings went to zero.
claude-opus-javascript-scan - SAST and hybrid SCA on a Claude Opus FastAPI applicationIndependent SAST and hybrid SCA on an application written by Claude Opus, covering both the generated code and the dependencies it introduced, with reachability evidence.
claude-opus-fastapi-sca - Runtime DAST with SAST correlation on AI-generated codeDAST found SQL injection on the running API of an AI-generated application, and SAST correlation confirmed the finding against the static result.
dast-sast-correlation
Claude Code security