AI tool · Anthropic
QA for teams writing with Claude Code
Claude Code runs in the terminal with a permission system: read-only by default, approval for edits and commands, and settings files that enforce deny rules. What it cannot enforce is whether the release passes.
Termscritical flow (a path a user takes that costs money or trust if it breaks: sign-up, checkout, invite, export) · verdict (a one-word release result (pass, pass with findings, fail) with the findings and the checklist version behind it) · CI (the pipeline that builds and tests every change before it can be merged or deployed) · client bundle (the JavaScript your app sends to the browser or ships inside the mobile app; anyone can read it) · protected branch (the git branch that cannot be pushed to directly and is the only source of production deploys) · LLM feature (a product feature that calls a large language model, such as an assistant or a summariser)
What Claude Code changes in a codebase
A terminal agent that reads the repository, edits files and runs shell commands under a permission system; CLAUDE.md files shape its behaviour and settings.json files enforce what it may do.
The permission model gives a team two levers: CLAUDE.md for guidance and settings.json for boundaries. The checklist belongs in the first (so generated code aims at the pass criteria) and production access in the second (so DR-03 holds). The release run then checks what came out.
Defaults, from the docs verified 2026-09-21
| Default, from the docs | Why it matters for release testing | Source |
|---|---|---|
| Read-only tools need no approval within the working directory; Bash commands require approval "except a built-in set of read-only commands"; file modification requires approval. | The default mode keeps a person between the model and every write or command; teams that relax it move the gate to CI. | docs verified 2026-09-21 |
| "acceptEdits" auto-accepts file edits and common filesystem commands; "bypassPermissions" "skips permission prompts" and the docs say to "only use this mode in isolated environments like containers or VMs." | A session in bypassPermissions with production credentials in the environment is the shape of the July 2025 database deletion; DR-03 inventories exactly that. | docs verified 2026-09-21 |
| "Permission rules are enforced by Claude Code, not by the model. Instructions in your prompt or CLAUDE.md shape what Claude tries to do, but they don't change what Claude Code allows." | Rules in CLAUDE.md are guidance; deny rules in settings.json are the boundary. A release checklist belongs in the guidance, a production deny rule in the boundary. | docs verified 2026-09-21 |
| Deny rules can block a tool or a pattern within it (for example Bash(rm *)); Read and Edit deny rules also apply to file commands in Bash and to redirection targets. | A repository can deny writes to environment files and to migration directories, which removes a class of secret and schema accidents before review. | docs verified 2026-09-21 |
| Organisations can set permissions.disableBypassPermissionsMode in managed settings so bypass mode cannot be used. | For a team with production access on developer machines, this is the setting that makes DR-03 hold. | docs verified 2026-09-21 |
Each row was read on the linked page on the date shown. Docs change; the date tells you how current the row is. Claude Code documentation.
Failure patterns most associated
- criticalAPI key shipped in the client bundle
A key meant for the server ends up in JavaScript the browser downloads, so anyone can read it and call the service as the app.
- criticalService-role key used from the front end
The database's bypass-everything key is used in client code, so row-level rules no longer protect anything.
- criticalSecret committed to the repository
A key or token is in git history, where it stays readable to anyone with repository access even after the file changes.
- criticalRow-level security off on a new table
A table created by a migration or SQL has no row-level security, so the anonymous key can read and write every row through the public API.
- criticalPolicy that allows everything
Row-level security is enabled but the policy condition is true for everyone, so isolation exists in name only.
- criticalList endpoint returns other tenants' rows
A list or search endpoint filters by the wrong column or none, so a user sees records belonging to other accounts.
- criticalObject fetched by id without an ownership check
An endpoint checks that the caller is logged in, then returns whatever id was requested.
- criticalAdmin gate enforced only in the UI
The admin page hides its buttons from ordinary users, but the underlying route or action accepts calls from anyone logged in.
How the checklist adapts
- DR-03 reads the permission mode in use and the deny rules in the repository settings; bypassPermissions with production credentials present is recorded as a finding.
- SC-02 pairs with a Read/Edit deny rule on environment files, which removes the most common way a key reaches the repository.
- DM-02 and DM-03 check that migration directories and production connection strings are outside what an agent session can write to.
- LLM items apply twice: to the product's model features, and to any hooks or tools the team gives the agent that touch production data.
Release checklist, five of the published items
v1.0 · verified on 2026-09-21Agents and tools hold no write credentials to production
manual Inventory every credential available to coding agents, CI jobs and developer machines.
No agent or developer session credential can write to production data or trigger a production deploy without a human approval step.
Development and production data stores are separate
manual Read the connection configuration for every environment and every tool or agent with database access.
No development, preview or agent environment holds a production connection string.
Production deploys are triggered only from the reviewed branch in CI
manual Read the deployment configuration and the last 10 production deploy records.
Every production deploy in the sample originates from CI on the protected branch; no local push or agent session deployed to production.
No secrets in repository history
tool Run a secret scanner (gitleaks or equivalent) over the full git history, not only the working tree.
Scanner reports zero unrevoked findings; any historical finding has a rotation record.
Destructive changes are gated behind a verified backup
manual For any migration that drops, truncates or rewrites data, confirm a backup taken within 24 hours restores into a scratch database.
The restore completes and a spot check of 10 rows matches production before the change is approved.
Which plan fits
Growth $5,900/mo
Claude Code teams tend to be small and ship often, with an LLM feature in the product more often than not; Growth covers the LLM items. Starter fits a web-only team without them.
For 8-15 engineers, daily releases, web plus API or one mobile platform. Limits, cadence and what is not included.
Questions
Claude code generated code review testing
How to test AI generated code?
Release rollback plan template
Get a risk list for your codebase
5 business days, $1,200, credited to the first month.