Claude Code Security and code review: how AI code is checked before it goes live

Claude Code writes in minutes what used to take a team days. Whether that code is secure, however, is decided not by the model but by the review that follows. This guide explains what Anthropic itself offers for this, where those tools stop, and how you can have every diff and every risky command checked before it reaches your software.

As of November 10, 2026. The information about Anthropic comes from the official documentation and announcement (sources below); Claude Code features change frequently.

How secure is the code that Claude Code writes?

As secure as the review it goes through: Anthropic states explicitly in the Claude Code documentation that you are responsible for checking proposed code and commands for security before approving them. The model works fast and is usually plausible, but it knows neither your business rules nor your production environment.

Claude Code comes with protective mechanisms for this. In manual mode, it starts with read-only permissions and asks before changing files or running commands. In auto mode, a separate classifier model evaluates the actions and blocks whatever it considers unsafe. In addition there are a sandbox for Bash commands and approvals for network access. These mechanisms protect against individual dangerous actions. They do not answer whether the finished code contains a vulnerability.

What is Claude Code Security, and what does it check?

Claude Code Security is Anthropic’s tool that scans an entire codebase for vulnerabilities and suggests patches; it was announced on February 20, 2026 as a limited research preview and, since the end of April 2026, has been available under the name “Claude Security” as a public beta for Claude Enterprise customers (heise, April 30, 2026). According to heise, Team and Max customers are to follow.

According to Anthropic, the tool does not search for known patterns like a classic scanner but traces how components interact and how data flows through the application. It therefore targets flaws in business logic and access control, which pattern matching finds poorly. Every finding goes through a multi-stage cross-check, gets a severity and a confidence rating, and ends up in a dashboard. Nothing is applied without human approval.

There are also two tools that work closer to the individual diff:

What does Claude Code Security not check?

All three tools check code for vulnerabilities; none of them stops a command before it runs, and none checks the workflow, that is, whether a plan was approved, a test really went red and then green, or a migration is reversible. That is not a weakness but a different purpose: they find flaws in the code, not mistakes in the procedure.

Anthropic itself names two limits. According to its description, the GitHub Action is not hardened against prompt injection and should only review trusted pull requests; for outside contributions, the repository recommends letting workflows run only after a maintainer’s approval. And the Action deliberately hides some types of findings to reduce false alarms, including denial of service, missing rate limiting and open redirects.

How do I have every Claude Code diff reviewed automatically?

With a review that does not come from the author of the code: as soon as the finished diff touches security-critical areas or exceeds a certain size, Code Guardian has it read by a separate review agent that knows neither the task nor the plan of the writing agent, and reports every finding with evidence. Whoever knows the plan reads in the diff what they expect; a cold reader reads what is actually there.

The package comes with 15 review agents that check independently of one another, plus five modes, seven gates and 22 detectors (as of Code Guardian 17.17). Without the additional package, proceed like this:

1. Before every commit, run /security-review over the pending changes.
2. For pull requests, set up Anthropic’s GitHub Action, for trusted contributions only.
3. Start the review in a new session or a subagent that does not know the plan.
4. Reproduce every finding before you fix it: a finding is a claim until a test or a command confirms it.

How a review of AI code works in detail is described in our guide Code review for AI-generated code.

Which security vulnerabilities must a review of AI code check?

The same as for human code, only at a higher pace: Anthropic’s own security review Action checks ten categories, from injection through authentication and data exposure to supply chain dependencies.

• Injection: SQL, commands, LDAP, XPath, NoSQL, XXE
• Authentication and authorization: missing permission checks, privilege escalation, session errors
• Data exposure: hard-coded secrets, sensitive data in logs, personal data
• Cryptography: weak algorithms, key management, insecure random numbers
• Input validation and business logic: missing validation, race conditions
• Configuration: insecure defaults, missing security headers, overly open CORS
• Supply chain: vulnerable dependencies, typosquatting
• Code execution and XSS: insecure deserialization, eval, cross-site scripting

With AI agents comes a danger that no diff shows: the command itself. An agent that has permission to execute can delete, deploy or migrate a database before any review runs.

How do I prevent Claude Code from running dangerous commands?

With a lock before the command instead of a reprimand afterwards: Code Guardian hooks into Claude Code and refuses four kinds of commands before they run, namely deleting, secrets in a commit, deploy and migration. The agent receives the reason as text and must first provide the missing proof.

Code Guardian stops a deploy command without a fresh check report, for example, with this message (shortened):

DEPLOY GATE (code-guardian): Deploy-Kommando ohne frischen Gate-Report.

You can get part of the way with Claude Code’s built-in means: enter commands in permissions.deny, turn on the sandbox with /sandbox and use managed settings across the team. A deny rule, however, only applies to the command as written; it does not catch the same effect achieved through a different command. How to vet third-party skills and extensions beforehand is covered in the guide Claude Code Skills.

Does this also work with Codex?

Code Guardian exists for Claude Code and for OpenAI Codex; in both editions, the same locks do the blocking. Some skills that read Claude Code’s session transcripts are only in the Claude Code package. Anthropic’s /security-review and the GitHub Action, by contrast, are tied to Claude; the Action needs a Claude API key.

Frequently asked questions

Is Claude Security free?

No, according to heise, Claude Security is available to Claude Enterprise customers; at the announcement, Anthropic offered free, accelerated access to maintainers of open-source projects. The GitHub Action is open source but uses up your Claude API quota.

Does an AI review replace a human review?

No. Even Anthropic lets nothing be applied without human approval in Claude Security. An AI review finds more in less time; the decision about what goes live stays with you. Who is liable for damage caused by AI code is explained in our guide on liability for AI-generated code.

What is the difference between a code review and a quality gate?

A code review assesses finished code. A quality gate applies before an operation and lets it run only once the proof is available, for example before a deploy or a migration. The two complement each other.

Have code from Claude Code checked before it goes live

Code Guardian runs in Claude Code and Codex, has risky diffs read by a cold review agent and stops risky commands before they reach your software. What this looks like day to day is shown in the how it works in slides; you will find the license and the product tour on the Code Guardian page.

Sources

• Anthropic: Making frontier cybersecurity capabilities available to defenders (20.02.2026)
• heise online: Claude Security – Anthropic bringt KI-Schwachstellenscanner für Unternehmen (30.04.2026)
• Claude Code documentation: Security
• GitHub: anthropics/claude-code-security-review

As of November 10, 2026. General information, not legal advice.