Supercov vs Claude Code for security review

The difference

Asked to review a repository for vulnerabilities, Claude Code with Sonnet 5 reads the code as an agent and reports what it finds. Supercov runs twelve fixed security checks on each file. Claude Code is more accurate. Supercov is about seventeen times faster and costs about a twentieth as much.

Results

72 deliberately vulnerable repositories, 2,016 labelled vulnerabilities.

	Supercov 2.0.1	Claude Code, Sonnet 5
F1	0.42	0.49
Finds	43%	44%
Right	42%	57%
Median time	10 s	2.8 min
Cost per repository	5¢	95¢

They find about the same share. Claude Code is right more often, so its F1 is higher.

By language

F1	Supercov	Claude Code, Sonnet 5
Python, 32 repositories	0.54	0.61
TypeScript, 27	0.36	0.40
JavaScript, 13	0.34	0.44

Choose Claude Code when

you want fewer false alarms to read through;
you already work in Claude Code and a minute or three per review is fine;
the issues you care about span files, like authorization.

Choose Supercov when

your agent should check every change without waiting;
you want the same checks each run, so a new finding means the code changed;
cost matters across many repositories.

Supercov also runs inside Claude Code: ask it to use npx supercov security, and it gets the results in seconds. See Accuracy, speed and cost for how this was measured.