Claude Code Security is here. Here's what it still doesn't cover.

What Claude Code Security actually does

Let's be accurate about this. Claude Code Security reads and reasons about your codebase the way a senior security engineer would. It doesn't match patterns — it understands context. That lets it catch vulnerabilities that pattern-matching tools structurally cannot: complex business logic flaws, broken access control, multi-step privilege escalation paths that only surface when you understand the full execution flow.

It runs multi-stage verification to filter false positives before findings reach your team. It assigns severity ratings. Everything surfaces in a dashboard for human review, and developers approve patches manually — nothing applies automatically. That is a deliberate design choice.

That is a real and significant capability. It is also, by design, an enterprise research preview. No CLI. No pre-commit integration. No CI/CD exit codes. The implications of those design constraints are exactly what this post is about.

The pipeline reality: security operates at four distinct stages

Most developers treat security tooling as a single category. It isn't. There are four distinct stages in a modern DevSecOps pipeline, each with different requirements, different failure modes, and different tools fit for the job.

Claude Code Security is designed for Stage 4. It cannot fulfill — and was not designed for — Stages 1, 2, or 3. Understanding why requires looking at what actually happens at the earlier stages.

What happens before Stage 4 — a real example

Here is a realistic Node.js/Express route. This is the kind of code that ships in production more often than most teams admit — particularly at the velocity that AI-assisted development now makes possible.

const express = require('express');
const router = express.Router();
const db = require('../db');

// Stripe API key — hardcoded for 'quick testing'
const STRIPE_SECRET = "sk_live_4eC39HqLyjWDarjtT1zdp7dc";

router.get('/users/profile', async (req, res) => {
  const { userId } = req.query;

  // Direct string concatenation — SQL Injection (OWASP A03:2025)
  const query = "SELECT * FROM users WHERE id = '" + userId + "'";
  const result = await db.query(query);

  res.json(result.rows[0]);
});

module.exports = router;

Two vulnerabilities. Both critical. Both caught by CodeSlick in under 3 seconds at pre-commit, before this file ever touches git history.

Now consider the hardcoded Stripe key specifically. If this file gets committed, the key is in your git history permanently. Deleting the file and pushing a fix does not remove it from history. Anyone with read access to the repository — current or former — can retrieve it with a single git command. The only remediation is to invalidate the key at Stripe immediately and audit all downstream usage. That work begins the moment the commit lands.

Claude Code Security can find this key in your existing repository. It cannot prevent the key from entering history in the first place. That window — between writing and committing — belongs entirely to Stage 1, and it is the most consequential window in your entire pipeline.

What Claude Code Security is not designed to do

These are not criticisms. They are design constraints — understood and accepted by Anthropic. Knowing them precisely is what lets you build the right stack.

How they fit together

A complete security posture requires coverage at all four pipeline stages. Claude Code Security covers Stage 4, and covers it well. Stages 1 through 3 require tooling built specifically for speed, automation, and pipeline integration.

Here is what that stack looks like end to end:

These are not competing for the same role. Claude Code Security's launch does not make Stages 1–3 redundant — it validates that the industry is taking full-pipeline security seriously. Teams with the most mature posture will run both. The choice between them is not a choice at all.

The argument for having both is not subtle. Build the fast layer first — pre-commit, CI gates, PR automation. Then add the deep audit layer on top. Skipping the infrastructure layer and relying on periodic audits means your commit history accumulates risk faster than any audit can clear it.

What to do today

If you are waiting for Claude Code Security to reach general availability before investing in your security toolchain: that is not a security strategy. That is a gap with a specific shape — and it is accruing interest in your git history right now.

The goal is not to pick the best security tool. It is to have no uncovered pipeline stage. Claude Code Security is a meaningful addition to the landscape. It also assumes you already have the infrastructure layer running underneath it.