Claude Code Generates IDR 40 Trillion Revenue; Indonesian Startups Can Build Websites Without Developers

Claude Code, Anthropic's software development agent, has surpassed an annual revenue of approximately US$2.5 billion (around IDR 40 trillion) and is now responsible for roughly 4% of all commits in public GitHub repositories. This figure underscores that artificial intelligence is no longer just a chatbot toy but a working tool used by non-programmers to release digital products into the real world.

For startup founders in Indonesia, the implications are immediately apparent. Instead of hiring developers at rates of hundreds of millions of rupiah or digital agencies that take weeks, a solo founder can now build a company website from scratch to launch with just a series of text commands. The realistic first-month cost: around US$30–35 (IDR 480,000–560,000), mostly for the domain and a US$20 per month Claude Pro subscription.

However, there's a pitfall rarely discussed. Tests on over a hundred AI models found that 45% of generated code samples failed security tests and revealed at least one vulnerability from the OWASP Top 10 list, with cross-site scripting being the most common error. This means smoothly running code isn't necessarily secure. Furthermore, Claude Code itself once had a vulnerability that allowed attackers to extract API keys through malicious repositories before users saw a trust warning, as documented by Check Point Research.

Anthropic provides three different interfaces that must be chosen appropriately. Artifacts, embedded within Claude.ai chat, is the fastest way to prototype static pages. Claude Design, launched in April 2026, builds design systems from existing brand assets, ensuring consistency across every generated screen. Meanwhile, Claude Code, released in February 2025 and generally available in May of the same year alongside Claude 4, is an agent with direct access to project files, capable of writing code, executing commands, and managing version control.

The workflow suggested by practitioners: rapid prototyping in Artifacts, formalizing the visual system in Claude Design, then handing it over to Claude Code to make it fully functional. Each stage has its own command structure, and skipping a step is the main reason why initial websites look generic or, worse, have security holes that outsiders can exploit.

"Treat generated code like a contractor's work: verify it before you rely on it, especially where customers enter emails, passwords, or card numbers," reads the warning in the guide.

In the Indonesian context, the adoption of such tools has the potential to transform the digital landscape for MSMEs. With over 64 million micro, small, and medium enterprises, only a fraction of which have an online presence, the ability to build affordable and fast websites could be a catalyst. However, cybersecurity literacy remains a barrier. Many business owners do not yet understand the importance of environment variables, input sanitization, or API key encryption. Without such understanding, AI-built websites risk leaking customer data.

The government, through the Ministry of Communication and Digital, also needs to pay attention to this trend. Personal data protection regulations, which are now in effect, require every electronic system operator to maintain the confidentiality of user data. If startups and MSMEs build websites with AI without security audits, they could unknowingly violate these rules. On the other hand, opportunities arise for security audit service providers and digital literacy training to bridge this gap.

Going forward, the question is no longer whether AI will replace developers, but rather how quickly Indonesia's ecosystem can prepare human resources capable of overseeing and verifying AI output. Without this, a boom in cheap websites might only lead to more wide-open backdoors.