Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is Claude Code Safe for Healthcare and Banking Codebases?
No. Anthropic's Claude Code documentation puts its sandbox around shell commands and leaves Read, Edit, Write, WebFetch, WebSearch, MCP servers and hooks outside it, so check what those tools can open in a repository that carries real records (Anthropic, 2026).
A claims platform team at an insurer asks to run Claude Code over the repository behind its own claims portal. The repository is mostly source, and it also holds the fixture of live claims extracts the test suite replays, a migration that seeds member records into a staging database, and a configuration file with the connection string for that database. The agent opens those files the way it opens any other: Read returns them, Edit changes an assertion, and a command runs the suite. The sandbox begins at the command, not at the file, and that order decides the review. A hospital or a bank starts with containment because containment is the question the vendor's page answers, then asks what the model read; on this record type the second answer arrives first. For example, the fixture carries a member name, a claim number and the bank account a reimbursement goes to, and every one of them is in the context before a command runs. The pages the agent opens around the work, the issue that reports the failing test and the console where a claim is checked, carry the same records in rendered form.
Key findings
- For Claude Code to be safe on a healthcare or banking codebase, the records in the repository would have to be kept out of the model's reach before it reads them, and the pages the agent opens would have to render consistent tokens, with real values resolving only at an approved destination (What Is Render-Layer Tokenization?).
- It would also require a named person approving each record change, deployment or payment the agent proposes, and a record of what the model received, exported to the organization's own monitoring (What Is an AI Control Record?).
- Anthropic's sandbox page describes the shell boundary and the file-tool rule, and it does not describe a record of what the model read (Anthropic, 2026).
- Anthropic's sandbox page states that the sandbox covers shell commands only, while Read, Edit, Write, WebFetch, WebSearch, MCP servers and hooks run outside it (Anthropic, 2026).
- GitGuardian counted "28,649,024 new secrets exposed in public GitHub commits across 2025," and Claude Code co-authored commits "leaked secrets at roughly double the baseline rate" (Help Net Security, 2026).
- A 2025 study bypassed 12 published defenses with "attack success rate above 90% for most," so a filter or a prompt does not settle what an agent reads (Nasr et al., 2025).
What does Claude Code read on a claims platform codebase?
Take one record type: a claims platform repository at an insurer. It holds the portal's source, the fixture the test suite replays, and a seed migration that writes the same records into a staging database. A developer asks the agent to fix a failing test, so it first opens the fixture with Read, then edits the assertion and runs the suite. The model receives the fixture because Read returns the file.
Anthropic's documentation puts the file tools under permission rules rather than the sandbox: Read, Edit and Write "follow permission rules instead," and a sandbox deny entry "doesn't stop the Read tool" (Anthropic, 2026). The rule that keeps a claims extract from the model is therefore a Read rule, written for the path, while the sandbox deny is a setting for commands. Does Claude Code Read My .env File? works through that distinction for a credential file; a fixture of claims extracts takes the same route.
The pages around the work are the second route. The agent opens the issue that reports the failing test and the console where a claim is compared. Those pages are rendered, so a browser control covers them; it does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. The two routes need two controls.
What does the model receive when Claude Code runs in its sandbox?
The sandbox is a boundary around a process, and the page names the process. It covers shell commands only, while Read, Edit, Write, WebFetch, WebSearch, MCP servers and hooks run outside it, and sandbox.credentials affects sandboxed Bash commands only (Anthropic, 2026). With masking, a sandboxed command sees a sentinel and a local proxy substitutes the real value only on the hosts in injectHosts, so a token stays out of a command's environment (Anthropic, 2026). On macOS a masked credential file cannot be read at all inside the sandbox, the same effect as deny (Anthropic, 2026).
What the sandbox decides is what a command can reach and send. What the model receives is decided by the tools outside it: a permission rule that denies a path, a hook that returns a value, an MCP server that carries its own credential. Is a Sandbox Enough to Make a Coding Agent Safe? separates containment from the data question.
Coder's page states that "LLMs and agents can be dangerous if not run with proper boundaries" and advises "separate identities with limited scope" for autonomous work (Coder, 2026). That governs the identity the agent runs under and the scope of its permissions; it still leaves the fixture, the page and the server to those tools.
Claude Code's own disclosure record is the other side of the safety question: 51 security flaws in the product have been published since February 11, 2025, 39 of them in the last twelve months, and 6 of the 39 let an attacker reach data the agent, its tools or its server could reach (How Many Security Flaws in AI Agents Were Published in the Last Year?). Those are published records rather than attacks, and on a codebase that holds claims extracts the number that matters is the six that reached data.
What do the vendors themselves say?
Anthropic documents two layers and is clear about the line between them. The sandboxing page states that the sandbox covers shell commands only, with Read, Edit, Write, WebFetch, WebSearch, MCP servers and hooks outside it, and that sandbox.credentials affects sandboxed Bash commands only (Anthropic, 2026). The same page gives the file-tool rule: a sandbox deny entry "doesn't stop the Read tool," and Read, Edit and Write "follow permission rules instead" (Anthropic, 2026).
Coder's page addresses the identity, not the reading: "LLMs and agents can be dangerous if not run with proper boundaries," and the advice is to "separate identities with limited scope" for autonomous work (Coder, 2026).
A record of what the model read is not described in the pages reviewed, and neither page describes an approver for the values a repository puts in front of the agent. The transcript is the account a team has of the run.
| Dimension | Anthropic, Claude Code, per its documentation | What a buyer should verify |
|---|---|---|
| Boundary | Shell commands only; file tools and web tools outside (Anthropic, 2026) | Which tools run outside it |
| File reads | Read follows permission rules; a sandbox deny does not stop it (Anthropic, 2026) | Which paths a Read rule denies |
| Credentials | sandbox.credentials covers sandboxed Bash; mask sentinel on injectHosts | Whether the credential is in a file Read can open |
| Identity | Separate identities with limited scope (Coder, 2026) | Which identity runs the agent, and who owns it |
The table reads down the column the review does: the page answers the command and the credential, and the file and the page stay with the team.
What do real records look like inside a repository?
A regulated repository is rarely only source. The claims platform's tree carries the fixture of extracts, a seed migration with member records, a log from a staging run, and a configuration file with a database URL. A hospital's tree carries a test patient and a billing extract; a bank's carries account numbers and a card range in a fixture.
The scanning record says these files travel. GitGuardian counted "28,649,024 new secrets exposed in public GitHub commits across 2025," and the same report counted "24,008 unique secrets exposed in MCP configuration files" (Help Net Security, 2026). Web agents "are prone to inadvertent use of unnecessary sensitive information," which on a claims console means the identifiers arrive with the task (Zharmagambetov et al., 2025).
Harvard's guidance lists seven risk categories for AI-enabled systems, including Sensitive Data Exposure and Privilege and Identity Misuse (Harvard University Information Security and Data Privacy, 2026). OWASP's Top 10 for agentic applications sets out the most critical risks for autonomous and agentic AI systems (OWASP Gen AI Security Project, 2025). How Do I Keep API Keys Out of Claude Code's Context Window? takes the credential case; for a claims fixture the question is simpler: does a Read rule name the path, and does anything record the read?
Who approves what Claude Code does with a repository record?
Approval in Claude Code sits on actions. A permission rule can require a person before a command runs or a tool is used, which controls what the agent does. It does not answer who approved the reading, because the reading precedes the action. In the claims record, a person may approve the push and the migration and never see the fixture was opened.
The research record says the action needs a person. The ToolEmu authors report that "even the safest LM agent exhibits such failures 23.9% of the time," counting risky actions such as irreversible ones (Ruan et al., 2024). A 2025 study bypassed 12 published defenses with "attack success rate above 90% for most" (Nasr et al., 2025). Harvard's guidance says to "Require human approval for high-impact, sensitive, irreversible, or externally visible actions whenever feasible" (Harvard University Information Security and Data Privacy, 2026).
A bank's review adds an identity question: New York's Department of Financial Services asks covered entities to "consider using authentication factors that can withstand AI-manipulated deepfakes" (New York State Department of Financial Services, 2024). A named approver for a record change is stronger than a prompt answered by whoever started the run. What Is Supervised Delegation? sets out the accountability side.
What does a governed environment change?
A governed environment is a control class that acts where a page is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so a claims console that carries a member name and an account number renders as CLAIM_004821 and ACCT_014. Real values resolve only at the approved destination, at the moment of an approved action. A named person confirms the policy and approves each action that changes a record, and every screen as tokens, every action and every approval is written to a record the organization exports to its own monitoring.
For this page's question, the change is in which layer decides exposure. The repository route is decided by the file-tool rules and by what the team keeps in the tree. The rendered route is decided by the environment. On the claims run, the console page is the rendered route; the fixture is the repository route, which a governed environment does not reach.
Its scope is the rendered page. It does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP, so a file the Read tool opens stays with the permission rule. RedactSure vs Claude Code: 2026 Comparison & Alternative sets the designs side by side.
What the record shows
What the model receives is the question that decides this review. Claude Code's documentation places the sandbox around shell commands and leaves Read, Edit, Write, WebFetch, WebSearch, MCP servers and hooks outside it, so a repository that holds claims extracts, member records or a connection string hands them to the model through a path the boundary does not govern (Anthropic, 2026). The page describes the permission rule that can deny a path and does not describe a record of what the model read. A healthcare or banking codebase fails on data before containment, and the answer changes only when the records are not there or are replaced before the model reads them. A reviewer can run a test on one repository: name one task, list every path the file tools can open and every server the agent can call, then compare the transcript with the list. If a claims extract is in the transcript, the read was uncontrolled; if the transcript holds tokens, the exposure was bounded before the model saw it.
Methodology and limitations
This page rests on Anthropic's Claude Code sandboxing page, Coder's best-practices page, three research preprints, a regulator's AI cyber letter, OWASP's agentic Top 10, Harvard's guidance and one press report, plus the RedactSure pages cited in the body. Vendor pages were read between October 16, 2026 and October 20, 2026, and each Sources line carries its date.
No product named here was tested for it. Where a page reviewed does not address a point, the page says so rather than treating silence as a denial, and that is what "not described in the pages reviewed" means. Vendor features change, and the page carries its date, so a release after October 20, 2026 is unreviewed until the checks are repeated. Statements about RedactSure describe its deployed behavior, and RedactSure is deploying now with enterprise and government customers. The example describes a record type, a claims platform repository and its claims extracts, not an organization.
Determinations about whether a coding agent or a permission rule meets a hospital's, a bank's or a regulator's requirement belong to counsel, assessors and the organization's security and compliance officers. Nothing here replaces a test on a copy of its own repository.
Frequently asked questions
Is Claude Code safe for healthcare and banking codebases?
No. Anthropic's documentation puts the sandbox around shell commands and leaves Read, Edit, Write, WebFetch, WebSearch, MCP servers and hooks outside it, so a repository that carries claims extracts or member records hands them to the model. What changes the answer is what the repository holds, not a setting on the sandbox. Start with the paths and the rule that keeps each one closed.
What does the model receive when Claude Code runs in its sandbox?
The files its tools open. The sandbox covers shell commands only, while Read, Edit, Write, WebFetch, WebSearch, MCP servers and hooks run outside it, so a fixture, a log or a configuration file arrives in full. Masking changes what a sandboxed command sees: it gets a sentinel while a proxy supplies the real value on injectHosts. That protects a command's environment, not a file returned by Read. Check the permission rule for every path.
Can Claude Code read a claims extract that sits in a test fixture?
Yes, if a permission rule allows it. Read follows permission rules rather than the sandbox, and a sandbox deny entry does not stop the Read tool, so the control for that path is a Read rule in the settings a team manages. A fixture copied from production is the usual way a claims extract lands in a tree. The rule decides whether the model receives it, and the transcript shows what it did.
Who approves what Claude Code does with a repository record?
A person can approve a command or a tool use, and that governs an action. It does not govern the read that came first, because the file is in the context before the action is proposed. For a record change, the approver should be named and outside the run, and the approval should name the record and the field. A prompt answered by the developer who started the run is not the same control. Ask who signed, and what they saw.
What record does a review get of what the model read?
From the sandbox page, none. It describes the boundary and the permission rule and no exported record of the model's reading. A team is left with the transcript, which shows what the agent did and may show the values it read, and with the repository history. An examiner needs the screen, the values, the action and the approver in one place, which is a record the page does not describe.
What should a security team ask for in writing?
The paths the file tools can open and the rule that denies each; the servers the agent can call and the credential each carries; what the model receives from a rendered screen and whether values are replaced before it reads; who approves a record change; and what the run exports. Ask for the answers beside a transcript from one repository. A vendor that cannot name the paths has not described the control.
How RedactSure Keeps Live Claims Data Off the Pages Claude Code Reads
The review centers on the repository and forgets the console where the agent traces a claim and records render in full. Anthropic's sandbox covers shell commands only, so neither the file nor the page is inside it.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens the claims console to compare a claim and the page renders the member's name, claim number and bank account. Inside the governed environment: the same page renders CLAIM_004821 and ACCT_014, and the real values reach the claims payment screen only when a named person approves.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A claims console that renders a member's bank account is the page an examiner will ask about. Bring one claims task and see, with test values, what the model reads and who approves the release. Book a demo