Security Considerations

Claude Code has powerful capabilities: file system access, command execution, and external service integrations. You need to understand the security principles for using this power safely.

Security Architecture

Claude Code is designed around a permission-based architecture:

• Read-only by default: It has read-only permissions by default
• Explicit approval: File edits, command execution, and the like require user approval
• Bash sandbox: A sandbox that isolates the file system and network (enable it with /sandbox)
• Sandbox credential blocking: The sandbox.credentials setting blocks commands running in the sandbox from reading credential files and secret environment variables (v2.1.187+)
• Scoped write access: Writes are allowed only in the starting directory and below; parent directories cannot be modified
• Prompt-fatigue prevention: Frequently used, safe commands are managed through per-user/per-project/per-organization allowlists
• Accept Edits mode: Instead of approving changes one by one, you can batch them for review/approval together
• Credential encryption: Credentials such as API keys are stored encrypted locally

Core Risk Factors

1. Prompt Injection

An attack where malicious instructions embedded in external data attempt to manipulate Claude's behavior.

Defense mechanisms:

• Permission system: Sensitive actions require explicit approval
• Context-aware analysis: Analyzes the full request to detect potentially harmful instructions
• Input sanitization: Input handling to prevent command injection
• Command blocklist: Commands that fetch web content, such as curl and wget, are blocked by default
• Network request approval: Tools that make network requests require approval by default
• Isolated context: WebFetch runs in a separate context window
• Command injection detection: Suspicious Bash commands require manual approval even if they're on the allowlist
• Fail-closed matching: Commands that don't match are handled as manual approval by default

Best practices:

1. Review proposed commands before approving
2. Don't pipe untrusted content directly into Claude
3. Always confirm proposed changes to important files
4. Consider using a VM when interacting with external web services
5. Report suspicious behavior with /bug

Known vulnerabilities (2025-2026)

CVE-2025-59536 and CVE-2026-21852 are vulnerabilities that allow remote code execution (RCE) and API key theft through malicious project configuration files. Take extra care when cloning untrusted repositories and working on them with Claude Code. It's a good idea to first check whether the .claude/ directory or CLAUDE.md file contains anything suspicious. Always keep Claude Code up to date.

2. Excessive Permissions

// Bad: allow everything
{
  "permissions": {
    "allow": ["Bash(*)"]
  }
}

// Good: allow only what's needed
{
  "permissions": {
    "allow": [
      "Read(*)",
      "Edit(src/**)",
      "Bash(npm test)",
      "Bash(npm run lint)"
    ],
    "deny": [
      "Bash(rm *)",
      "Bash(git push *)",
      "Bash(curl *)"
    ]
  }
}

3. Sensitive Information Exposure

# Risky: include the entire .env file in context
cat .env | claude -p "analyze this config file"

# Safe: strip sensitive fields before passing it
env | grep -v "KEY\|TOKEN\|SECRET\|PASSWORD" | claude -p "review this config"
cat api-response.json | jq 'del(.token, .api_key)' | claude -p "analyze this"

4. Untrusted MCP Servers

MCP servers access your data through Claude. The list of allowed MCP servers is defined in configuration files in your source code — write them yourself or use only servers from trusted providers. Anthropic does not manage or audit third-party MCP servers.

5. Windows WebDAV Risk

Windows users, take note

When running Claude Code on Windows, do not enable WebDAV or allow access to paths that could include WebDAV subdirectories such as \\*. Microsoft no longer recommends WebDAV due to security risks. With WebDAV enabled, Claude Code could trigger network requests to a remote host and bypass the permission system.

Cloud Execution Security

When using Claude Code on the Web (cloud execution), there are additional security controls:

Security control	Description
Isolated VM	Each cloud session runs in an isolated, Anthropic-managed VM
Network access control	Restricted by default; can be disabled or limited to specific domains
Credential protection	Authentication through a secure proxy, using scope-limited credentials inside the sandbox
Branch restriction	git push is restricted to the current working branch
Audit logging	All actions are logged for compliance and audit purposes
Automatic cleanup	The cloud environment shuts down automatically after the session completes

Remote Control sessions are different. The web interface connects to a Claude Code process on your local machine, so all code execution and file access happen locally. No cloud VM or sandboxing is involved, and data is transmitted over TLS.

Required .gitignore Settings

# Claude Code local settings (may contain API keys)
.claude/settings.local.json

# Local-only settings
.env
.env.local
.env.*.local
*.pem
*.key

The project-level .claude/settings.json can be shared with the team, but never include API keys or personal information in it.

Organization-Level Security Policies

Managed Settings

In Enterprise/Team, managed settings enforce organization-wide security standards:

// Example managed policy
{
  "permissions": {
    "deny": [
      "Bash(rm -rf *)",
      "Bash(git push --force *)",
      "Edit(*.env)"
    ]
  },
  "disableBypassPermissionsMode": "disable"
}

Managed settings take precedence over all lower-level settings.

Specifying Security Policies in CLAUDE.md

## Security Policy

### Never do
- Connect directly to the production database and use Claude
- Include files containing customer PII (personally identifiable information) in context
- Hardcode API keys or passwords in code
- Deploy Claude-generated code to production without review

### Recommended
- Work in a local development or staging environment
- Require the security team to review security-related code
- Verify behavior with a test run before large-scale automation work

Team Security Best Practices

• Enforce organization standards with managed settings
• Share approved permission settings under version control
• Train team members on security best practices
• Monitor Claude Code usage with OpenTelemetry metrics
• Audit or block configuration changes during a session with the ConfigChange hook

Audit Logs

Use hooks to leave an audit log of important actions:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "echo \"[$(date -u '+%Y-%m-%dT%H:%M:%SZ')] USER:$(whoami) CMD:$CLAUDE_TOOL_INPUT_COMMAND\" >> ~/.claude-audit.log"
          }
        ]
      }
    ]
  }
}

Subagent execution can also be audited with the SubagentStart/SubagentStop hooks.

Claude Code Security Tool

A code security analysis tool announced by Anthropic in February 2026. Unlike traditional SAST (static analysis) tools, it finds vulnerabilities through reasoning rather than pattern matching.

Item	Description
Engine	Reasoning-based analysis powered by Claude Opus 4.6
Results	Found 500+ vulnerabilities in open-source projects that had gone undetected for decades
False-positive prevention	Filters false positives through multi-stage validation (discover → analyze → re-verify)
Strengths	Business logic flaws, complex conditional vulnerabilities, and other areas existing tools miss
Availability	Research preview for Enterprise/Team customers

Using it alongside existing SAST tools can significantly raise your codebase's security level.

Security Checklist

Check before adopting Claude Code:

• API keys managed as environment variables (never hardcoded in code)
• Only minimal permissions granted in settings.json
• Claude-related sensitive files added to .gitignore
• Team security policy specified in CLAUDE.md
• MCP server source code reviewed
• Tools restricted with --allowedTools in CI environments
• Audit logging configured (if needed)
• WebDAV confirmed disabled on Windows
• Permission settings audited regularly with /permissions
• Consider using a devcontainer for sensitive code work

Security vs productivity

If your security settings are too strict, productivity drops. Apply deny rules only to genuinely risky commands (rm, deploys, external transmission), and allow ordinary development tools to keep productivity up.

Reporting security vulnerabilities

If you find a security vulnerability in Claude Code, don't disclose it publicly — report it through Anthropic's HackerOne program. Include detailed reproduction steps, and give Anthropic time to fix the issue before disclosure.