App built with Claude Code: the security check before going live

Claude Code works right in your repository: it creates files, installs packages, writes migrations. It is excellent at shipping fast, and it follows your instructions. But it only knows what you tell it about your access rules, your sensitive data and your deployment.

An independent analysis after each big work session, or on every push, gives you an overview the agent doesn’t have: every flaw in the project, ranked by severity, with the fix prompt to hand back to it.

Ten free analyses every month, no card needed. First report in minutes.

Analyse my app for free

The most common flaws

Sensitive files added to the repository

A .env file, a private key or an access token committed by mistake is readable by anyone with access to the repository.

Incomplete access control

An API route or server action added at the end of a session without checking the user: the most common flaw in generated apps.

Dependencies added unchecked

Each package the agent installs widens the attack surface. Citadel compares every version against public vulnerability databases.

Overly broad database rules

Supabase “true” policies, tables without RLS: a quick fix to unblock a screen becomes an open door.

What Citadel checks (27 live checks)

Code, dependency and secret analysis against OWASP and CWE. Every flaw comes with a plain explanation and the fix prompt to paste into your assistant.

Next.js version vulnerable to middleware bypass (CVE-2025-29927) A06 · CVE
Secret exposed in a NEXT_PUBLIC_ variable CWE-200 · A02
dangerouslySetInnerHTML fed with external data CWE-79 · A03
Redirect built from URL parameters CWE-601 · A01
images.remotePatterns open to every domain CWE-918 · A10
Source maps published in production CWE-540 · A05
child_process.exec or spawn with user input CWE-78 · A03
eval, new Function or vm on external data CWE-95 · A03
File path built from the request (path traversal) CWE-22 · A01
JWT verified without an algorithm allow-list or with a weak secret CWE-347 · API2
Session cookies without HttpOnly, Secure or SameSite CWE-1004 · CWE-614
CORS: * origin combined with authentication cookies CWE-942 · A05
service_role key used in client code CWE-798 · A07
Tables exposed without Row Level Security enabled CWE-284 · A01
Permissive policies: USING (true) or WITH CHECK (true) CWE-284 · A01
Secrets in the code and config files (100+ key types) CWE-798 · A07
npm and Composer dependencies with published CVEs or GHSA advisories A06 · CVSS
Passwords hashed with MD5, SHA-1 or unsalted CWE-916 · A02
http:// redirects to https:// CWE-319 · A02
HSTS present with a sufficient duration CWE-319 · A05
CSP present, without unsafe-inline or unsafe-eval CWE-693 · A05
Protection against embedding in another page (clickjacking) CWE-1021 · A05
Secure, HttpOnly and SameSite cookies CWE-614 · CWE-1004
CORS open to every site with cookies CWE-942 · A05
nosniff and Referrer-Policy headers, server version hidden CWE-693 · CWE-200
Forms sent in clear text, or password passed in the URL CWE-319 · CWE-598
Forms without an anti-CSRF token, or sent to another domain CWE-352 · CWE-201

Frequently asked questions

How do I use Citadel with Claude Code?

Connect your GitHub repository to Citadel and turn on analysis on every push. Each flaw comes with a fix prompt ready to paste into Claude Code; a new analysis then confirms the fix.

Is my code kept?

No. It is analysed in an isolated container with no internet access, then deleted as soon as the analysis ends. Only the results are kept, with secrets masked.

How much does it cost?

The Free plan includes ten analyses a month, no card needed. Paid plans add Citadel AI, analysis on every push and team work.

Other guides

Vibe coding security: the checklist before you put your app online

By tool

By technology