Claude Code security: the tool, the code it writes, and how to harden both

Claude Code's core protection is its permission system: before it edits files or runs a shell command, it asks, and you approve or deny. You can build allowlists for commands you trust and deny rules for things it should never touch. Those prompts are the security boundary — the tool is as safe as the permissions you grant it. Your code is processed by Anthropic's API when you use it, so the code you open in it should be code you're comfortable leaving your machine, same as any cloud coding tool.

Three habits cover most of the risk. First, deny it access to secrets: add your .env files and credential stores to the deny list so a scan, a debug session, or a misfired command never puts live keys into a transcript. Second, treat --dangerously-skip-permissions as what its name says: it removes the security boundary entirely, and it belongs only inside an isolated container or VM with nothing valuable in reach — never on your main machine with your real credentials. Third, remember that anything the agent reads is input: a malicious README, a poisoned web page, or a compromised dependency's docs can try to steer the agent (prompt injection). The permission prompts are what stand between a hijacked instruction and an executed command, which is the practical argument for not turning them off.

Better than the worst of AI codegen, and not good enough to skip review. Coding agents optimise for the thing you asked for — working software — and security is usually not in the prompt. The patterns that show up are boringly consistent across tools: API keys pasted where the code needed credentials, endpoints that check whether someone is logged in but not whether they should see that record, SQL assembled from strings because it was the shortest path to working, debug settings that never got flipped for production.

We see this directly: secure·vibes scans self-described vibe-coded and AI-built repos all day, and our 549-repo benchmark found the same handful of finding types over and over regardless of which agent wrote the code. None of this means the code is unusable — it means the security pass is a separate, later step that the agent doesn't do for you unless you make it.

Standing instructions help more than one-off prompts. A security section in your CLAUDE.md — no hardcoded secrets, environment variables for all credentials, parameterised queries only, no eval on input — applies to every session in that repo without you remembering to ask. It raises the floor; it does not replace verification, because agents follow rules imperfectly and codebases accumulate code from before the rules existed.

Verification is a scan of the actual repo. Paste the GitHub link into secure·vibes and you get a 0–100 score, every finding with file and line, and — the part that closes the loop — a ready-to-paste Claude prompt per finding, so the same tool that wrote the vulnerability applies the fix as a small, reviewable diff. Fix, re-scan, watch the score move. That's the whole discipline: rules set the floor, the scan finds what slipped through, Claude Code fixes what the scan found.