# Supercov vs Claude Code for security review

> Claude Code with Sonnet 5 is more accurate; Supercov is 17 times faster at a twentieth of the cost. Measured on 72 vulnerable repositories.

Web page: https://supercov.com/compare/security/claude-code · Published 2026-09-25
All Supercov pages for agents: https://supercov.com/llms.txt · Full text: https://supercov.com/llms-full.txt

## The difference

Asked to review a repository for vulnerabilities, Claude Code with Sonnet 5
reads the code as an agent and reports what it finds. Supercov runs twelve
fixed security checks on each file. Claude Code is more accurate. Supercov is
about seventeen times faster and costs about a twentieth as much.

## Results

72 deliberately vulnerable repositories, 2,016 labelled vulnerabilities.

| | Supercov 2.0.1 | Claude Code, Sonnet 5 |
| --- | ---: | ---: |
| F1 | 0.42 | 0.49 |
| Finds | 43% | 44% |
| Right | 42% | 57% |
| Median time | 10 s | 2.8 min |
| Cost per repository | 5¢ | 95¢ |

They find about the same share. Claude Code is right more often, so its F1 is
higher.

## By language

| F1 | Supercov | Claude Code, Sonnet 5 |
| --- | ---: | ---: |
| Python, 32 repositories | 0.54 | 0.61 |
| TypeScript, 27 | 0.36 | 0.40 |
| JavaScript, 13 | 0.34 | 0.44 |

## Choose Claude Code when

- you want fewer false alarms to read through;
- you already work in Claude Code and a minute or three per review is fine;
- the issues you care about span files, like authorization.

## Choose Supercov when

- your agent should check every change without waiting;
- you want the same checks each run, so a new finding means the code changed;
- cost matters across many repositories.

Supercov also runs inside Claude Code: ask it to use
[`npx supercov security`](https://supercov.com/docs/security.md), and it gets the results in seconds.
See [Accuracy, speed and cost](https://supercov.com/docs/security-benchmark.md) for how this was measured.


Evidence: [every scanner's results (JSON)](https://supercov.com/downloads/security-benchmark-2026-09-25.json) · [Supercov's reports, timings and scoring script (ZIP)](https://supercov.com/downloads/supercov-security-benchmark-2026-09-25.zip). Measured September 25, 2026 on 72 RealVuln repositories.