HOW THE CLAUDE CODE TEAM DOES CODE REVIEW

Summary from the TLDR InfoSec newsletter

To account for the number of changes being made, Anthropic shifted to a model where Claude Code serves as the primary code reviewer, with most PRs requiring at most one human in the loop. Developers run tests, builds, and lints, etc., locally before opening a PR. Every PR runs standard CI checks, plus a security and bug review. A classifier then determines whether zero, one, or two reviewers are needed before the change enters a merge queue, and changes are rolled out internally via feature flags before reaching a public release. Anthropic uses data from incidents as well as metrics from PRs to evaluate and tune their reviewer agents.