Security Audit for Claude Code Apps: CVE-2025-66032 and Beyond

Why Claude Code Requires a Different Security Approach?

Launch Ready Code benchmark: across the 700+ apps we've scanned, the average Launch Readiness Score is ~44/100 — most ship with at least one critical finding. — LRC scan data, 2026

Launch Ready Code has scanned 700+ applications. Most ship with at least one critical finding, and the average Launch Readiness Score is ~44 out of 100 — LRC scan data, 2026.

Most AI coding assistants are passive. They suggest code. You decide whether to use it. Claude Code is different. It is an agentic tool that can read files across your filesystem, execute shell commands, install dependencies, modify multiple files in a single operation, and connect to external services through MCP tool integrations.

This is genuinely useful. It can also create an attack surface that standard IDE assistants do not have. When you give Claude Code permission to run Bash commands, you are extending your own permissions to the agent. When you connect an MCP server, you are adding an external service to that permission chain. This is an insider threat model: the agent has the same access as a trusted developer.

CVE-2025-66032 was the first high-profile exploit of this model. Shell command parsing errors in versions before 1.0.93 could allow arbitrary code execution. The fix was shipped in 1.0.93, but the vulnerability demonstrated that agentic access creates a new category of risk that does not exist in passive tools.

What is Four Agentic Attack Vectors in Claude Code?

What is step 1: Prompt Injection (CWE-94, CAPEC-242)?

Prompt injection occurs when malicious content in your data manipulates the agent’s behavior. A user submits input that contains instructions disguised as text. The agent processes that input and executes the embedded instruction. In Claude Code, this could mean reading a sensitive file, writing to a production config, or executing a shell command the user instructed.

This is CWE-94 (Improper Control of Generation of Code) at the agent layer. Validate all external data before it reaches the agent. Never pass raw user input to Claude Code as context without sanitization. If your app uses Claude Code to process user-submitted content, add a validation layer between the user input and the agent’s context.

What is step 2: Secrets in Git History (T1552, CWE-312)?

Claude Code can commit code to your repository as part of its agentic workflow. If the agent places a secret in a file and commits it — even temporarily — that secret is in your Git history. Git history is permanent. Rotating the key stops future misuse but does not close the exposure window.

Set up a .gitleaks.toml configuration and run gitleaks in CI before every merge. Our gitleaksScanner catches this pattern in our audit pipeline. Run git log -p | grep -E "(sk-|sk_live|service_role|AKIA)" to check your existing history.

What is step 3: Hallucinated Dependencies (T1195, Supply Chain)?

Claude Code can suggest and install packages to complete a task. AI models sometimes suggest packages that do not exist, are no longer maintained, or have been squatted by malicious actors. Before any Claude Code session adds a new dependency, verify it against the NIST National Vulnerability Database and check the package’s download history and maintenance status.

What is step 4: Filesystem Access Scope Creep?

Claude Code operates with broad filesystem access by default. If you do not restrict its scope, a compromised session or injected prompt could read your .env files, your SSH keys, or your cloud configuration. Use the managed-settings.json configuration to restrict the directories the agent can access. Apply the least-privilege principle: the agent should only have access to the directories required for the current task.

What is App-Level Security: The Same Gaps as Every Other AI Builder?

Beyond the agentic risks, apps built with Claude Code face the same production security gaps as apps built with any other AI tool. Claude Code writes the code. Nobody turns on Row Level Security. Nobody adds rate limiting. Nobody sets HTTP security headers. The gaps left behind are the same gaps we find across the AI-built apps every month.

What should you know about OWASP Coverage for Claude Code Apps?

The security gaps in Claude Code-built apps map to the OWASP Top 10:

• A01:2021 Broken Access Control — Missing auth middleware (CWE-306) and disabled RLS on Supabase tables (CWE-284). CVE-2025-48757 documented 170+ apps with this gap.
• A02:2021 Cryptographic Failures — Secrets in the client bundle or committed to Git (CWE-200, CWE-312). Our gitleaksScanner.js:4 treats any secret in a public asset as critical.
• A03:2021 Injection — Prompt injection via user input (CWE-94) and SQL injection from string concatenation (CWE-89).
• A05:2021 Security Misconfiguration — Missing CSP, HSTS, X-Frame-Options headers. Broad filesystem scope in Claude Code sessions.
• A07:2021 Authentication Failures — No rate limiting on auth endpoints (CWE-307). Missing CSRF protection on state-changing routes (CWE-352).

The CISA Secure by Design guidance specifically calls out agentic AI as a new attack surface category requiring additional controls beyond standard software security practices. The CVE-2025-66032" target="_blank" rel="noopener">NIST NVD entry for CVE-2025-66032 documents the shell parsing vulnerability fixed in v1.0.93.

What is Checklist: Securing Your Claude Code Session and Shipped App?

What should you know about Before Each Claude Code Session?

1. Verify you are on v1.0.93 or later. Run claude --version. CVE-2025-66032 affects all earlier versions.
2. Restrict filesystem scope. Configure managed-settings.json to limit access to the project directory. Exclude .env, SSH keys, and cloud config directories.
3. Review MCP tool permissions. Only connect MCP servers that need access to the current task. Disconnect servers not needed for the session.
4. Enable per-step approval for Bash commands. Review each shell command before allowing execution. Do not enable auto-approve for sessions involving sensitive configuration.

What should you know about After the Session, Before You Ship?

1. Scan Git history for accidental key commits. git log -p | grep -E "(sk-|sk_live|service_role|AKIA)". Rotate any key found in history.
2. Review all agent-generated auth code. Every route that should require login must have server-side middleware. Test each one unauthenticated.
3. Enable RLS on every database table. Owner-scoped policies. Test with the public anon key to confirm access is denied on protected data.
4. Add rate limiting to auth and AI endpoints. Burst 30 requests. If no 429 comes back, you have no rate limiting.
5. Set security headers. CSP, HSTS, X-Frame-Options, X-Content-Type-Options. Check our security headers checker.
6. Add error tracking. Break something on purpose. An alert should fire. If you hear nothing, you are blind in production.
7. Run the URL scan. launchreadycode.com/free-scan tests what an attacker sees from outside. 30 seconds, score out of 100.

What should you know about From Free Scan to Full Audit?

The free scan catches the most common production gaps in 30 seconds. The Launch Readiness Audit Report ($499, one-time) covers all four dimensions — security, reliability, performance, monitoring — with file-and-line references for every finding, a ranked fix roadmap, and senior review.

For apps built on Claude Code that handle EU users, the EU AI Act’s Article 50 transparency requirements apply from August 2026. Our Compliance Wing covers both the security and compliance sides. Our existing Claude Code security audit guide covers more on the platform security approach.

Frequently Asked Questions