Security

Claude Code can run shell commands, edit files, and fetch URLs. Permission rules decide which of those actions run without asking, which prompt you, and which n…

Claude Code follows your CLAUDE.md most of the time. A hook makes something happen every time. Hooks are shell commands (or HTTP calls, prompts, or MCP tool cal…

When a few engineers use Claude Code, each person's ~/.claude/settings.json is enough. When a company rolls it out to hundreds, someone has to make sure every s…

Many companies already run an LLM gateway, such as LiteLLM, a cloud API gateway, or an in-house proxy, between their developers and the model providers. Claude …

Claude Code cloud sessions normally run on Anthropic-managed VMs. A self-hosted environment keeps the same developer experience (start a session from claude.ai,…

A security review of Claude Code has to answer two kinds of question. What happens to our data once it leaves the laptop: is it used for training, how long is i…

The Model Context Protocol (MCP) is an open protocol for exposing tools, resources, and prompts to AI applications over JSON-RPC 2.0. One server can serve many …

Claude Code reads configuration from a small set of files in your project and in ~/.claude, and writes session data to ~/.claude as it works. Knowing which file…

Manual permission prompts protect you only while you read them. After the twentieth "Allow npm test?" in a refactoring session, most people approve on reflex, a…

A permission check in front of a wire-transfer approval endpoint times out. What should happen next? One engineer's instinct says "don't block the transfer over…

HTTPS and a valid JWT only prove the front door locked. Many real API incidents happen after authentication succeeds: a user changes /orders/42 to /orders/99 an…

Many .NET teams stop at "add [Authorize] and check roles." That covers two of seven authorization models ASP.NET Core ships with — and leaves you reaching for h…

A partner script scrapes your API with a leaked key. A mobile build ships a password in every header. A "Sign in with GitHub" button works until someone treats …