Claude Code is a coding agent, not a hosting platform; hosting, database rules and payments are decided by the project it works in. Anthropic does not security-audit third-party MCP servers, per the security page.
Claude Code is Anthropic's coding agent for the terminal, IDE and browser. It works inside an existing project, does not host apps, and in Manual mode asks before editing files or running commands that modify the system. Permission rules can deny reads of .env files and other paths.
As with any coding agent, the app it helped write carries the patterns of its stack. The list here is the cross-stack set plus the agent-permission pattern: an agent with production credentials can do what any script with those credentials can do.
Each row is taken from the vendor's documentation on the date shown. Defaults change; the date is the claim.
| Area | Default | Source |
|---|---|---|
| Frontend | Claude Code works inside an existing project and does not choose a stack or host apps; it runs in the terminal, IDE extensions, a desktop app and the web. | docs · verified 2026-09-21 |
| Permission mode | In Manual mode Claude Code starts read-only and asks before file edits and before Bash commands that can modify the system. A built-in set of read-only commands such as ls and git status runs without asking. Which mode a session starts in depends on plan, surface and settings. | docs · verified 2026-09-21 |
| Working directory boundary | In Manual mode it can only write to the folder where it started and its subfolders, and asks before reading paths outside that boundary. | docs · verified 2026-09-21 |
| Network access | Commands that fetch web content such as curl and wget are not auto-approved by default; web fetch uses an isolated context window. | docs · verified 2026-09-21 |
| Secrets / env vars | API keys and tokens for Claude Code itself are stored in the macOS Keychain when available and protected by file permissions on Windows and Linux. | docs · verified 2026-09-21 |
| bypassPermissions mode | Skips permission prompts, including writes to protected paths such as .git and .claude; the docs say to use it only in isolated environments such as containers or VMs. Organizations can disable it via settings. | docs · verified 2026-09-21 |
Documentation home: code.claude.com/docs/en/overview
52 patterns in the catalogue name Claude Code; the most severe are listed here across secrets and keys, data access, login and permissions, payments. Attribution is descriptive: the default stack makes the pattern reachable, or a public incident names it.
The build writes the secret's value into public JavaScript, so anyone who loads the site can read it, and a redeploy with the same variable name republishes it.
Everyone who can see the repository, now or later, holds working keys to the database, payment account and model provider, and the keys stay in history after the file is deleted.
Anyone who opens the app can copy the key from the downloaded JavaScript and read, change or delete every row in every table.
Anyone with the app's public Firebase config, which sits in its JavaScript, can read, overwrite or delete the entire database and storage bucket without signing in.
Anyone who changes the id in a URL or request can read, edit or delete another customer's record.
Signed-out visitors or other customers can read rows meant for one account, while the owner sees an empty page and nobody notices.
Anyone who creates a free account can page through every other customer's records, which is a data breach with a sign-up form as the only step.
Anyone with the project URL and the public anon key, both of which sit in the app's JavaScript, can read, edit or delete every row in the table.
The table looks protected in the dashboard, yet any visitor with the public anon key can read, insert, update and delete every row.
A stranger who types /admin or /api/admin into the address bar can see or change everything the owner can.
Anyone who calls the API directly, or edits the page in developer tools, gets the data and actions the screen was hiding.
Anyone who reads the code or guesses a common placeholder can sign in as the administrator.
Anyone can write their own token naming another user, or an admin, and the server will act as that person.
A visitor who edits the signup request, or updates their own profile, can make themselves an admin.
Anyone who finds the webhook URL can post a made-up payment-succeeded event and get an order fulfilled or a plan activated for a user of their choosing, without paying.
Lovable reported that from 3 February to 20 April 2026 a backend regression let any logged-in Lovable user read the chat history and source code of public projects; a fix shipped within two hours.
Apr 2026 · Lovable · all sources
One education app built on Lovable had 16 vulnerabilities, 6 critical; a database function denied callers whose role was 'authenticated', so anonymous callers passed and 18,697 user records were readable without login.
Feb 2026 · Taimur Khan · all sources
A scan of 1,645 Lovable-built apps found 170 (about 10.3%) with database endpoints readable without login because Supabase row-level security policies were missing or too broad; recorded as CVE-2025-48757, CVSS 9.3.
May 2025 · Matt Palmer (Replit, Inc.) · all sources
Moltbook, a social network for AI agents built with AI-generated code, ran a Supabase database without row-level security policies, leaving 1.5 million API tokens and 35,000 email addresses readable and writable without login.
Feb 2026 · Wiz Research · all sources
Each entry links to its primary source in the evidence list. What to do about it is the self-check below.
Stated from the vendor's documentation. The limits are the vendor's scope statements, not judgements.
Permission rules and modes
Allow, ask and deny rules per tool, checked into version control or set as managed policy; modes include Manual, acceptEdits, plan, auto (classifier reviews actions) and bypassPermissions. Rules are enforced by Claude Code, not by the model.
Where it stops: Deny rules match the command as written; exec wrappers and find with -exec always prompt, and the docs say you are responsible for reviewing proposed code and commands.
vendor docs · verified 2026-09-21
Sandboxed Bash tool
Filesystem and network isolation for Bash commands on macOS (Seatbelt), Linux and WSL2. By default commands can write only to the working directory, added directories and the session temp directory, and no network domains are pre-allowed.
Where it stops: Not supported on native Windows or WSL1. Default read access covers the whole machine including credential files unless denyRead or credentials settings are added. The proxy does not inspect TLS by default. The docs state sandboxing is not a complete isolation boundary.
vendor docs · verified 2026-09-21
Prompt injection safeguards
Context-aware analysis, input sanitization, command injection detection, fail-closed matching in Manual mode, trust verification for new codebases and MCP servers.
Where it stops: Trust verification is disabled with the -p flag; the docs state no system is completely immune to all attacks.
vendor docs · verified 2026-09-21
Cloud session isolation
Anthropic-hosted cloud sessions run in isolated VMs with network access limited by default, scoped credentials, push restricted to the working branch and audit logging.
Where it stops: Self-hosted environments make isolation, egress and git credentials the deployment's responsibility; Remote Control sessions run locally without VMs or sandboxing.
vendor docs · verified 2026-09-21
The critical patterns first. Each uses the dashboard and your browser.
.env files, list every variable whose name starts with NEXT_PUBLIC_.NEXT_PUBLIC_ variable holding a server-only key, or a search hit for that key's value in a loaded script..env, .env.local, .env.production, serviceAccountKey.json or firebase-adminsdk files.sk_live, sk-, service_role, BEGIN PRIVATE KEY and password=.git log --all -p -S sk_live -- . | head. Any output means a live key has been committed at some point.service_role and then for sb_secret_.supabase.co, and read the apikey header under Request Headers.Claude Code pre-launch checklist
52 checks, in the order we run them. Usable without buying anything.
Self-check tool
Answer questions about your app and get the patterns that apply, ordered by severity. Runs in your browser; nothing is sent.
For founders about to let real users in.
$490
For anyone who wants the three riskiest areas checked fast.
$290
All packages and prices. Every report includes a re-check after your fixes.
Claude Code documents permission modes, a sandboxed Bash tool, prompt-injection safeguards and isolated cloud sessions. Keep production credentials out of the working directory, use deny rules for secret files, and review generated database and auth code before deploying.
We test the app the agent helped build, not the agent: permission checks, secrets, database rules, payments, error handling, and CI. Findings are written so you can paste the fix direction back into Claude Code.
Treat it like code from a fast new colleague: review the parts that touch money and personal data, and test them with a second account. The pre-launch check does that in 48 hours.