CLAUDE.md examples from real projects

apacheCLAUDE.md

pinot

apache/pinot/CLAUDE.md

requested full reviews and changes that benefit from independent domain review, especially compatibility, concurrency, security, and distributed state changes. Small changes can be reviewed directly. Reuse review evidence while

No other project uses it yet

simbasjunglesReads credentialsCLAUDE.md

free-my-tv

simbasjungles/free-my-tv/CLAUDE.md

kill-server; adb nodaemon server &`), or allow the terminal app under System Settings → Privacy & Security → Local Network. 7. **Tell them what the switch does** before they make it: the home

bethingtonReads credentialsCLAUDE.md

ghidra-mcp

bethington/ghidra-mcp/CLAUDE.md

anyone's issue/PR/comment text, never touch draft PRs, never merge around a contributor, and security reports / hostile threads / anything reputational default to "Ben posts personally" unless he explicitly chooses agent

fengshao1227Reads credentialsCLAUDE.md

ccg-workflow

fengshao1227/ccg-workflow/CLAUDE.md

rule 用了错误的 skill 名（#148）**：`ccg-skills.md` 指示 AI 调用不带 `ccg:` 前缀的命令名，但实际注册的命令是 `/ccg:verify-security` 等。AI 按 rule 调用失败后跳过质量关卡。修复：所有引用改为带 `/ccg:` 前缀。 ### 2026-06-18 (v3.1.6) - ✨ **CodeGraph

No other project uses it yet

fengshao1227CLAUDE.md

ccg-workflow / templates

fengshao1227/ccg-workflow/templates/CLAUDE.md

docs` | 新建模块 → 生成 README.md + DESIGN.md 骨架 | | `verify-module/` | `/ccg:verify-module` | 模块完成后 → 扫描结构完整性 | | `verify-security/` | `/ccg:verify-security` | 新模块/安全变更/重构 → 漏洞扫描 | | `verify-change/` | `/ccg:verify-change` | >30 行变更 → 文档同步状态分析

No other project uses it yet

hacdiasCLAUDE.md

webdav

hacdias/webdav/.claude/CLAUDE.md

CLAUDE.md Guidance for Claude when working in this repository (`hacdias/webdav`). ## Handling security advisories Advisory state lives on GitHub and is driven with the `gh` CLI: `triage → draft → published`, plus `closed

No other project uses it yet

CountlyCLAUDE.md

countly-server

Countly/countly-server/CLAUDE.md

plugin tests countly plugin lint name # Lint plugin countly shellcheck # Validate shell scripts ``` ## Critical Security Rules **ALWAYS follow these - no exceptions:** 1. **API endpoints must use validation**: ```javascript const { validateRead

hieunc229Reads credentialsCLAUDE.md

mailflare

hieunc229/mailflare/CLAUDE.md

RATE_LIMIT`) since it skips Turnstile. Device keys are listed and revoked under Settings → Security (`/api/devices`), hidden from the API keys list, and `deleteUserSessions` revokes them all (password change, reset

coleam00CLAUDE.md

ottomator-agents / claude-skill-archon

coleam00/ottomator-agents/claude-skill-archon/CLAUDE.md

Include helper scripts**: Python, shell, etc. in `scripts/` - **Use `allowed-tools`**: Restrict tools when security matters - **Show error handling**: Demonstrate proper error patterns - **Add type hints**: Make Python code clear

coleam00Reads credentialsCLAUDE.md

ottomator-agents / livekit-agent

coleam00/ottomator-agents/livekit-agent/CLAUDE.md

Control**: Pin all dependency versions 6. **Monitor Usage**: Track token usage and costs 7. **Secure Credentials**: Never commit API keys 8. **Document Tools**: Provide clear descriptions for all tools

SenteLabsAIReads credentialsCLAUDE.md

OpenExecutive

SenteLabsAI/OpenExecutive/CLAUDE.md

server/`, auth, `orchestrator/outbound_guard.py`, the cached prompt blocks or `.gitignore` gets a pass from the `security-reviewer` agent (or `/security-review`) before the PR opens. - Every non-draft PR also gets

VercelCLAUDE.md

streamdown / website

vercel/streamdown/apps/website/.claude/CLAUDE.md

Prefer simple conditionals over nested ternary operators - Group related code together and separate concerns ### Security - Add `rel="noopener"` when using `target="_blank"` on links - Avoid `dangerouslySetInnerHTML` unless absolutely necessary

No other project uses it yet

alibabaCLAUDE.md

QLExpress

alibaba/QLExpress/CLAUDE.md

QLInstruction` 子类 | | **数据体系** | `runtime/data/` | 值类型和类型转换 | `Value`, `DataValue`, `ObjTypeConvertor` | | **上下文** | `runtime/context/` | 脚本执行环境 | `ExpressContext`, 多种实现 | | **安全策略** | `security/` | 反射安全隔离 | `QLSecurityStrategy`, 4 种策略 | | **执行追踪** | `runtime/trace/` | 表达式执行路径记录 | `ExpressionTrace`, `TracePointTree` | --- ## 3. 主要的包和类的组织方式 ### 3.1 分层结构 ``` 表现层

zenml-ioCLAUDE.md

zenml

zenml-io/zenml/CLAUDE.md

reuse opportunities, quality issues, and efficiency improvements. Fix any issues it finds before committing. ### Security Guidelines - **NEVER** commit secrets, API keys, tokens, or passwords - Use environment variables or ZenML

zenml-ioReads credentialsCLAUDE.md

zenml

zenml-io/zenml/.github/CLAUDE.md

linting.yml, spellcheck.yml, zizmor.yml, check-links.yml, check-markdown-links.yml, gitbook-redirect-check.yml, validate-changelog.yml | Code quality, docs links, changelog, and workflow security checks | | **Release/Nightly** | release.yml, release_prepare.yml, release_finalize.yml, publish_*.yml, nightly_build.yml | PyPI, Docker, Helm, stack template, and nightly

useplunkReads credentialsCLAUDE.md

plunk

useplunk/plunk/CLAUDE.md

Database: `DATABASE_URL`, `DIRECT_DATABASE_URL` (for Prisma client generation) - Standard: `NODE_ENV` **Runtime:** - Security: `JWT_SECRET` - Database: `DATABASE_URL`, `DIRECT_DATABASE_URL` - Infrastructure: `REDIS_URL` - **Application URLs** (injected

GitHubReads credentialsCLAUDE.md

gh-aw / engines

github/gh-aw/docs/src/content/docs/reference/engines/claude.md

Claude Code engine configuration, supported tools, runtime behavior, and limitations.

shuvonsecCLAUDE.md

claude-bug-bounty

shuvonsec/claude-bug-bounty/CLAUDE.md

none/confusion/crack), OOB blind-bug confirmation (interactsh), LLM red-team corpus | | `skills/mcp-server-audit/` | MCP server security — tool poisoning, param→sink injection (path/cmd/SSRF/SQL), missing approval gates, result-channel secret leaks, rug-pull/confused-deputy

0xebCLAUDE.md

TheBigPromptLibrary

0xeb/TheBigPromptLibrary/.claude/CLAUDE.md

content is primarily markdown documentation for educational purposes around prompt engineering and LLM security research. ## Repository Structure - **SystemPrompts/** - System prompts from various LLM providers (OpenAI, Anthropic, Google, Meta

aaddrickDeletes or force-pushesCLAUDE.md

claude-desktop-debian

aaddrick/claude-desktop-debian/CLAUDE.md

Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/).** Bullets grouped under Added / Fixed / Changed / Deprecated / Removed / Security; one bullet per change; PR link for the deep dive; inline **BREAKING** prefix for breaking changes