Just ran Claude Code's code review on a few of our real, older repos. Wanted to see if it would flag the known security issues we'd since fixed.
I fed it three vulnerable code snippets:
* A Python function with a shell injection vulnerability.
* A Terraform config with S3 bucket wide-open to the public.
* A Dockerfile running as root.
Here's what it caught and missed:
**What it caught:**
* The S3 bucket public ACLs. Gave a clear warning and the corrected `acl` argument.
* Running as root in the Dockerfile. Suggested a non-root user.
**What it missed:**
* The shell injection. It suggested some style improvements but didn't flag the `os.system` call with unsanitized input as a critical vulnerability.
**My take:**
It's decent for basic hygiene and cloud misconfigurations. Don't rely on it as your sole security scan. It's not a Snyk or SonarQube replacement. Use it for a first-pass, especially on IaC and container configs, but follow up with dedicated security tooling.