Claude Code is one of the most capable coding assistants, and its code quality is high. But capability does not translate into security by default. In our scans, apps built with Claude and Claude Code had a high-severity flaw rate statistically identical to every other AI tool, dominated by hardcoded secrets and disabled TLS. A smarter model writes a better app around a leaked key; it does not stop the key from being leaked.
From our scan data
In our scan, roughly 1 in 8 Claude-built web apps had a high-severity flaw, the same rate as Codex and Cursor.
The risks that actually matter
Hardcoded credentials
The top finding. Claude Code inlines a key when that is the shortest path to running code, and the commit trailer makes it easy to find in history.
Disabled TLS verification
Certificate checks turned off to get past a local error, then shipped.
Weak randomness and missing auth
Math.random used for tokens, and generated routes that skip authorization, both common unless you prompt for security.
How to secure a Claude Code app
- Add a secrets rule to CLAUDE.md so keys are read from environment variables.
- Install a gitleaks pre-commit hook to block inline keys.
- Review generated routes for authorization and TLS settings.
- Scan the repo before it goes public.