How real projects brief Claude Code: the commands, conventions and warnings they put in CLAUDE.md.
PrismorSecCLAUDE.mdPrismorSec/prismor/CLAUDE.md
Prismor Security — CLAUDE.md This project is the Prismor security package for AI coding agents. ## Prismor Runtime Protection This repo has Prismor hooks enabled. The hook dispatcher at `prismor/runtime/cli.py` monitors tool
MeridionaCLAUDE.mdMeridiona/meridian/CLAUDE.md
infra/hf-proxy` (`hf.meridiona.com`) was an unauthenticated reverse proxy to huggingface.co. Its header carried a thoughtful `SECURITY:` block about cache-key poisoning and auth headers leaking into a shared cache; it never
briiirussellCLAUDE.mdbriiirussell/cybersecurity-skills/CLAUDE.md
Skills should refuse destructive or malicious use cases - Focus on educational value and professional security workflows - Keep descriptions "pushy" — include all relevant trigger phrases so the skill activates when needed
tae0yCLAUDE.mdtae0y/real-estate-mcp/CLAUDE.md
ruff check --fix && uv run ruff format # Type check uv run pyright # Security scan uv run bandit -c pyproject.toml -r src/ # Start MCP Inspector for interactive testing
ai-sdlc-frameworkCLAUDE.mdai-sdlc-framework/ai-sdlc/CLAUDE.md
developer`, `code-reviewer`, `test-reviewer` → **sonnet** (cost-efficient for mechanical tasks) - `security-reviewer` → **opus** (reasoning-heavy; the one role where Opus pays for itself) On dispatch paths (`/ai-sdlc execute`, `/ai-sdlc
VasiHemanthCLAUDE.mdVasiHemanth/tokentelemetry/.claude/CLAUDE.md
always exempt, so the default local experience is unchanged. CORS is **not** the security boundary (it only restrains browsers); the token is. Frontend carries it via `Authorization: Bearer` (and `?token
nwiizoCLAUDE.mdnwiizo/tfmcp/CLAUDE.md
handling ## Documentation | File | Contents | |------|----------| | [rules/quality-commands.md](.claude/rules/quality-commands.md) | Build, test, CI commands | | [rules/development-guidelines.md](.claude/rules/development-guidelines.md) | Code style, security rules | | [docs/architecture.md](.claude/docs/architecture.md) | Module structure, features | | [docs/configuration.md](.claude/docs/configuration.md) | Environment variables, Docker | | [docs/mcp-tools.md](.claude/docs/mcp-tools.md) | Tool
zamesinCLAUDE.mdzamesin/Next-Move-Theory-Canon-and-Skills/CLAUDE.md
criteria, margin, or demand (a HIPAA buyer; a 200-engineer org that triggers a security review) — and even then, never the first cut. - **Same expected outcome + different success criteria
cbcoutinhoCLAUDE.mdcbcoutinho/nextcloud-mcp-server/CLAUDE.md
keycloak`, `basic` **SQLite Tables**: - `refresh_tokens` - OAuth refresh tokens with user profiles - `audit_logs` - Security audit trail - `oauth_clients` - DCR OAuth client credentials - `oauth_sessions` - OAuth flow session state
autonomous-aiCLAUDE.mdautonomous-ai/autonomous-os/CLAUDE.md
response) | `robots/lamp/docs/physical-controls.md` | `robots/lamp/docs/vi/physical-controls_vi.md` | | Autonomous Buddy (Mac companion app) | `integrations/companions/autonomous-buddy/docs/autonomous-buddy.md`, `integrations/companions/autonomous-buddy/docs/autonomous-buddy-mvp.md`, `integrations/companions/autonomous-buddy/docs/release-signing.md` | `integrations/companions/autonomous-buddy/docs/vi/autonomous-buddy_vi.md`, `integrations/companions/autonomous-buddy/docs/vi/autonomous-buddy-mvp_vi.md`, `integrations/companions/autonomous-buddy/docs/vi/release-signing_vi.md` | | Security test checklist | `robots/lamp/docs/security-test.md` | _(no vi version)_ | **Reachy Mini docs** (`robots/reachy-mini/docs/` + `robots/reachy-mini/docs/vi/`): | Code area | English
dollspace-gayCLAUDE.mddollspace-gay/chainlink/CLAUDE.md
subissues for tasks >500 lines - End with handoff notes before context compresses --- *Language rules, security requirements, and testing guidelines are in `.chainlink/rules/` and auto-injected based on detected project languages
BelkinsCLAUDE.mdBelkins/ai-dive-deep/CLAUDE.md
migrations — is designed by a human before an agent writes it**, and gets a security review before merge
coleam00CLAUDE.mdcoleam00/remote-agentic-coding-system/CLAUDE.md
process async **Health Checks:** - `GET /health` - Basic health check - `GET /health/db` - Database connectivity check **Security:** - Verify webhook signatures (GitHub: `X-Hub-Signature-256`) - Use `express.raw()` middleware for webhook body (signature
LangChainCLAUDE.mdlangchain-ai/langchain-aws/CLAUDE.md
flaky tests) - [ ] Does the test suite fail if your new logic is broken? ### Security and risk assessment - No `eval()`, `exec()`, or `pickle` on user-controlled input - Proper exception handling
mizchiCLAUDE.mdmizchi/skills/CLAUDE.md
build artifacts (`_build/`, `.mooncakes/`) or `node_modules/` — `.gitignore` covers them. - If a skill gains security-sensitive detail, move it to chezmoi-local and remove from this repo
iansinnottCLAUDE.mdiansinnott/obsidian-claude-code-mcp/CLAUDE.md
Falls back to `~/.claude/ide/` (legacy location) - **Path Handling**: All paths normalized via `normalizePath()` utility - **Security**: File operations restricted to vault boundaries - **Multi-Vault Support**: Each vault needs unique HTTP port
tableauCLAUDE.mdtableau/tableau-mcp/CLAUDE.md
GLOBALLY`: Emergency kill switch - `CSP_ALLOWED_DOMAINS`: Comma-separated list of domains for Content-Security-Policy (default: `https://*.online.tableau.com,https://*.tableau.com`) ## Testing Strategy ### Unit Tests (`vitest.config.ts`) - Located in `src/` alongside
kousenCLAUDE.mdkousen/claude-code-training/CLAUDE.md
Larger teaching-library skills used during Lab 6 (api-documentation-skill, spring-boot-skill, security-review-skill, plus a plugin example). - Skills cover Java modernization, Spring scaffolding, security reviews, documentation
19-84CLAUDE.md19-84/redd-archiver/CLAUDE.md
Builds all 4 images (builder, search-server, nginx, mcp-server), runs compose integration test | | Security | `security.yml` | push, PR, weekly | CodeQL analysis + Trivy filesystem scan | | Mirror | `mirror.yml` | push (main), manual | Push
ericjyparkCLAUDE.mdericjypark/codex-island/CLAUDE.md
password prompt returns hours after granting, same app version | Claude Code's ~8h `security add-generic-password -U` rewrite resets the item's partition list to `apple-tool:`, silently wiping
A file Claude Code reads at the start of every session. It holds the commands, conventions and warnings the agent needs for this project.
At the repository root. Claude Code also reads CLAUDE.md files in subdirectories when it works there.
Build and test commands, the project's layout, conventions that aren't obvious from the code, and mistakes to avoid. Short files tend to work better than long ones.
Claude Code reads CLAUDE.md; most other agents read AGENTS.md. Many projects keep one and point the other at it.
