Claude Code

US CLOUD Act exposureProprietary

Homepage ↗

USAGE ON STAV · LAST 12 WEEKS

Where Claude Code shows up on Stav.

Live usage rolls up every five minutes. We surface the 12-week trend once enough requests have flowed through this app.

STAV REVIEW · LAST REVIEWED 06/21/2026

“Dominant agentic coding CLI with ~18M installs, but 30 CVEs in 16 months — including a CVSS 10.0 RCE and silent sandbox fixes — demand explicit risk acceptance before any deployment.”

Good for

Engineering teams that accept vendor-cloud Inference routing and need a mature, high-adoption agentic coding workflow out of the box
Organisations running Claude enterprise plans who can redirect model Inference through AWS Bedrock or Google Vertex AI for cloud-tenancy data-residency control
Teams comfortable maintaining weekly cadence on GHSA advisory updates and pinning to the latest patched release at Anthropic's daily release pace
Developers already using the VS Code ecosystem who want agentic multi-file edits and shell execution without standing up separate infrastructure

Watch out for

All prompts and code context route directly to api.anthropic.com — no self-hosted or Sovereign deployment mode exists, full US CLOUD Act jurisdiction applies unconditionally
Anthropic's privacy policy (effective 2026-07-08) explicitly permits inputs and outputs to be used for model training unless you opt out at the account level; telemetry is on by default to three endpoints including Datadog and GrowthBook
30 published GHSA advisories since February 2025 (~12 in the past 90 days, peak CVSS 10.0); two additional sandbox bypasses were silently patched with no CVE, advisory, or changelog entry — the public count understates the true incident history
SOC 2 certification, DPA availability, SBOM publication, and binary signing status are all unconfirmed from public documentation; verify directly with Anthropic before approving use in any regulated environment

Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.

MODEL REQUIREMENTS

What Claude Code needs from a model.

Required

Streaming
Tool calling

Recommended

Extended thinking
Long context (≥128k)
Native code execution

Data flow & telemetry

How Claude Code moves data between the client, the inference endpoint and any vendor-owned services.

Data flow

Direction: direct_to_vendor
Stores prompts: Yes

Telemetry

Collects telemetry: true
Privacy policy: https://www.anthropic.com/privacy

Vendor & licensing

Developer: Anthropic
Vendor country: US
Vendor type: scaleup
Funding status: vc_funded
Runtime type: cli
Open source: No
Licence: Proprietary
Licence risk: commercial
CLOUD Act exposure: Yes

Security & maintenance health

Security profile

Bug Bounty: true
Auto Update: true
Cve Count 90d: 12
Last Cve Date: 2026-06-13
Sbom Published: false
Cve Count Total: 30
Signed Binaries: false
Has Security Txt: true
Highest Cvss 365d: 10

Maintenance health

Archived: false
Commits 90d: 100
Last Commit: 2026-06-20
Contributors: 25
Contributors 90d: 25