SCAN YOUR CLAUDE CODE APP FOR VULNERABILITIES

Claude Code is Anthropic’s terminal agent: it reads your repo, edits files, runs commands, and drives whole features end to end — with hooks and MCP servers extending what it can touch. What it builds is a conventional web app in whatever stack you asked for: Next.js, Express, FastAPI, Rails, Go. The agent’s own trust model (permissions, hooks, MCP) is one problem, covered in our safety analysis. The deployed app is the other — and that is what attackers see.

The recurring failure is the review gap. An agent session produces a branch-sized diff; the human reads the plan and the summary, skims the code, and merges. The vulnerabilities that survive this are absences, not bugs: the route whose auth gate exists in a comment but not in code, the handler that validates nothing, the debug logging that prints request bodies — credentials included.

Secrets compound it: keys pasted into prompts and CLAUDE.md files during sessions have a way of ending up in source, fixtures, and transcripts nobody re-reads. Scanning the deployed URL tests what actually shipped, independent of how good the session transcript looked.

Common vulnerabilities we find in Claude Code apps

These are the shapes we look for first in apps built with terminal agents.

Auth gates that exist only in comments

A recognizable Claude Code artifact: a new API route with // TODO: add auth check or a comment describing the auth requirement — and no middleware enforcing it. The happy-path test passes because it never sends an unauthenticated request.

Exploit shape: call the route with no session and read the response. Fix direction: mount auth at the router level so new routes inherit it —

const r = Router();
r.use(requireAuth); // every route below is gated

— and test every route with zero credentials before merging.

Broken object-level authorization (BOLA)

Agent-generated CRUD checks that a session exists, then fetches by ID without confirming ownership. Sign in as user B, replay user A’s request with A’s UUID, and the API hands over A’s record. One missing owner_id comparison per route is the difference between multi-tenant and public.

The shape and its fixes are cataloged in BOLA in AI-generated CRUD; the manual test is copy a request, swap the UUID, re-fire.

Command and path injection in glue code

Claude Code excels at glue: scripts that shell out, endpoints that read files, converters that call CLI tools. Generated glue frequently uses child_process.exec with interpolated user input, or builds file paths from request parameters.

Exploit: ; cat /etc/passwd in a filename field, or ../../.env in a path parameter. Use execFile with array args instead of exec, resolve paths against a base directory, and verify the result stays inside it:

const p = path.resolve(BASE, userInput);
if (!p.startsWith(BASE + path.sep)) throw new Error("traversal");

Credentials in logs and prompting residue

Two related leaks. Generated debug logging prints whole request bodies — including passwords and tokens — into production logs, because “log the request for debugging” is the pattern the model reaches for. And secrets pasted into prompts or CLAUDE.md during a session get echoed into code, fixtures, or committed config.

Grep session diffs for console.log near auth code and for key prefixes (sk_, eyJ, AKIA); rotate anything that ever entered a prompt, because transcripts persist under ~/.claude/projects/.

Hallucinated and unvetted dependencies

The agent installs packages mid-session to solve small problems. Some don’t exist under the suggested name — which is how typosquatted malware gets installed — and others carry known CVEs into your lockfile.

Diff your manifest after every session, confirm unfamiliar packages have a real registry history, and run npm audit / pip-audit in CI. The Package Hallucination Scanner automates the phantom-package check.

Mass assignment on write endpoints

Generated create/update handlers pass req.body straight into the ORM: User.update(req.body). Any field a client adds — role: "admin", credit_balance: 9999 — gets written if the column exists.

Exploit: add one JSON field to an otherwise legitimate request. Fix: validate against an explicit field allowlist at the boundary and construct the update object by hand — see mass assignment.

How VibeEval works with Claude Code

1. Enter your deployed URL. Point the scanner at staging, a preview deploy, or production. No repo access and no framework assumptions — the scan sees the app exactly as an attacker does.
2. The agent attacks the running app. A browser-driven agent signs up, logs in, and probes: replaying requests across accounts to find BOLA, calling API routes directly to expose missing auth and validation, checking bundles and responses for leaked keys, and testing headers, CORS, and error behavior.
3. You get findings with paste-ready fix prompts. Each finding carries severity, the evidence trail, and a remediation prompt written for an AI agent. Paste it into your next Claude Code session, review the diff, redeploy, and re-scan to confirm closure.

Manual testing vs VibeEval

Manual review still owns logic and architecture. The scanner owns repeatability: every Claude Code session can regress the app’s security posture, and re-running the same attack suite after each one is only practical when it’s automated.

Frequently asked questions

Does VibeEval integrate with Claude Code?

Yes — VibeEval offers an MCP integration, so the agent can trigger scans and pull findings without leaving the terminal. The core loop works without it too: deploy, scan the URL, paste the fix prompts into your next session.

Is Claude Code safer than other AI coding tools?

The trust model is more transparent — you can see every tool call before it runs, and permissions are configurable per command. But the generated code shows the same patterns as every AI coder: missing auth, BOLA, unvalidated input. Agent transparency and shipped-app security are separate problems; see Is Claude Code Safe?.

What about hooks and MCP servers — does the scanner check those?

No — hooks and MCP configuration are local agent-environment concerns, covered by the Claude Code checklist. VibeEval tests the deployed application, which is where the consequences of an unsafe session end up.

What stacks does VibeEval support for Claude Code apps?

Any stack that serves HTTP. Because the scan is black-box against the deployed URL, it is indifferent to whether the agent wrote TypeScript, Python, Ruby, or Go — the vulnerability classes it hunts live at the protocol layer.

Can Claude Code fix the issues VibeEval finds?

Yes, and that is the intended loop. Findings ship as paste-ready prompts; feed one to Claude Code, review the resulting diff — especially anything it deletes — redeploy, and re-scan to verify the finding is gone.

Related Claude Code resources

• How to Secure Claude Code — permission modes, settings.json allowlists, CLAUDE.md guardrails, and MCP audit.
• Is Claude Code Safe? — the trust boundary: CLAUDE.md, MCP servers, skills, and --dangerously-skip-permissions.
• Claude Code Security Checklist — pre-launch checklist covering settings, hooks, MCP tool-spec injection, and the Agent SDK.
• MCP and tool-spec injection — how poisoned tool descriptions turn an agent against its user.
• Vibe Code Scanner — the general-purpose scan for any AI-built app.

Test your Claude Code app before launch

An agent session that looked flawless in the terminal can still ship an app with no auth on half its routes. Point VibeEval at the deployed URL, get the findings, and paste the fixes back into your next session — before someone else runs the same tests uninvited.