Supercov vs Claude Code for security review

The difference

Asked to review a repository for vulnerabilities, Claude Code with Sonnet 5 reads the code as an agent and reports what it finds. Supercov runs twelve fixed security checks on each file. Supercov finds more; Claude Code is right more often. Supercov is about seventeen times faster and costs about a twentieth as much.

Results

72 deliberately vulnerable repositories, 2,016 labelled vulnerabilities.

	Supercov 2.0.1	Claude Code, Sonnet 5
F1	0.41	0.49
Finds	56%	44%
Right	33%	57%
Median time	10 s	2.8 min
Cost per repository	5¢	95¢

Supercov finds more of the vulnerabilities, 56% against 44%. Claude Code is right more often, so its F1 is higher.

By language

F1	Supercov	Claude Code, Sonnet 5
Python, 32 repositories	0.54	0.61
TypeScript, 27	0.36	0.40
JavaScript, 13	0.34	0.44

Choose Claude Code when

you want fewer false alarms to read through;
you already work in Claude Code and a minute or three per review is fine;
the issues you care about span files, like authorization.

Choose Supercov when

your agent should check every change without waiting;
you want the same checks each run, so a new finding means the code changed;
cost matters across many repositories.

Supercov also runs inside Claude Code: ask it to use npx supercov security, and it gets the results in seconds. See Accuracy, speed and cost for how this was measured.

Security review skills don’t change this much. In our test of three popular skills and /security-review, none made Claude Code find more vulnerabilities.