Securing code written with Claude Code: a review checklist

Claude Code does not host your app or choose your stack. It works in the folder where you start it, reads your files, proposes edits and runs shell commands. Anthropic's security documentation describes a permission-based design: in Manual mode it starts with read-only permissions and asks before editing files or running commands that can change your system, and it can only write inside the folder where it was started and its subfolders. Other permission modes change which actions prompt you, so confirm which mode your sessions actually start in.

There are two trust boundaries. The first is between the agent and your machine: every command you approve runs with your user account's access to files, credentials and the network. The second is the normal one for any app: whatever the generated code ships to a browser is public, and only server-side checks protect data. Claude Code can write either kind of code well or badly, and nothing about the tool moves the boundary for you.

The documentation states the responsibility plainly. Claude Code only has the permissions you grant it, and you are responsible for reviewing proposed code and commands for safety before approval. It also says that while its protections reduce risk, no system is completely immune to all attacks.

Claude Code reads permission rules from settings files, and the documentation says rules are evaluated in the order deny, then ask, then allow, so a deny rule cannot be overridden by a narrower allow rule. A Read deny rule blocks Claude's file tools from reading a path. The example below follows the documented pattern syntax. Put it in .claude/settings.json so it is shared with everyone who clones the repository.

{
  "permissions": {
    "deny": [
      "Read(.env)",
      "Read(.env.*)",
      "Read(secrets/**)"
    ]
  }
}

The first two lines are typed inside a Claude Code session. Anthropic documents /security-review as an on-demand security pass over the changes on your current branch, and notes that it reads source code rather than a running site. The rest run in your normal terminal. Adjust the secret patterns to the providers you use and the audit command to your package manager.

/permissions
/security-review

git ls-files | grep -E "\.env|\.pem$|credentials"
grep -rnE "sk_live_|sb_secret_|service_role|BEGIN PRIVATE KEY" --exclude-dir=node_modules --exclude-dir=.git .
git log --all -p -S"sk_live_" | head -50
npm audit

An agent optimises for the task you gave it. If you asked for a working dashboard, you will get one, and the question of who else can load that data may never have come up. Read generated code for three habits: the server checks the session before doing anything, the user id comes from the verified session and never from the request body, and queries are scoped to the current user or their organisation. OWASP describes the missing version of that last check as an insecure direct object reference.

Anthropic publishes a security guidance plugin that has Claude review its own changes for common vulnerabilities during a session. Its documentation is careful about limits: none of its layers block writes or commits, the review model can miss issues, and it should be treated as one layer of defence in depth, not a complete security solution. Use it if it suits you, and keep the outside-in tests regardless.

Be careful with untrusted input. The documentation's advice for prompt injection includes reviewing suggested commands before approval, avoiding piping untrusted content directly to Claude, and verifying proposed changes to critical files. A web page, an issue comment or a dependency's README can all contain instructions aimed at the agent.

• Approving commands without reading them because the last twenty were fine.
• Choosing always allow for a broad shell pattern to stop the prompts.
• Running with permission prompts skipped on a laptop that holds cloud credentials. The docs say to use that mode only in isolated environments like containers or VMs.
• Pasting a live API key into the chat so the agent can test something. Rotate any key that has been in a prompt, a file or a commit.
• Letting the agent fix a failing test by loosening an authorisation check, a database policy or a CORS rule.
• Adding an MCP server from an unknown source. Anthropic says it does not security-audit or manage any MCP server.
• Treating a clean automated review as proof. It reads code, not your deployed app.

Review permission settings whenever they change in a pull request, since they are part of your security configuration. Repeat the secret searches and the two-account test before each release. Pass condition: the agent cannot read your secret files through its file tools, no secret appears in the repository or its history, and the finished app refuses anonymous and cross-user requests.