How real projects brief Claude Code: the commands, conventions and warnings they put in CLAUDE.md.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
HeliconeCLAUDE.mdHelicone/helicone/CLAUDE.md
useJawnClient()` ### Database - PostgreSQL with snake_case naming - ClickHouse for analytics - Proper RLS policies for security ## Tech Stack ### Frontend - Next.js 14 with React 18.3.1 - TypeScript, Tailwind CSS, Radix UI - Zustand
Steady2 mentions in 2 weeks
No other project uses it yet
bethingtonReads credentialsCLAUDE.mdbethington/ghidra-mcp/CLAUDE.md
anyone's issue/PR/comment text, never touch draft PRs, never merge around a contributor, and security reports / hostile threads / anything reputational default to "Ben posts personally" unless he explicitly chooses agent
appleboyCLAUDE.mdappleboy/ssh-action/CLAUDE.md
Docker containers (tests `./` local action) - `.github/workflows/stable.yml` - Tests against published `appleboy/ssh-action@v1` tag - `.github/workflows/trivy-scan.yml` - Automated security scanning for vulnerabilities and misconfigurations ## Testing ### Running Tests Tests run automatically via GitHub Actions workflows
Steady4 mentions in 2 weeks
No other project uses it yet
eberttiCLAUDE.mdebertti/awesome-telegram/CLAUDE.md
links) - The entry is a crypto trading bot that requests API keys via Telegram (security risk) - The content appears to be self-promotion of paid/adult/gated content groups - The PR title
apacheCLAUDE.mdapache/pinot/CLAUDE.md
requested full reviews and changes that benefit from independent domain review, especially compatibility, concurrency, security, and distributed state changes. Small changes can be reviewed directly. Reuse review evidence while
kuafuaiReads credentialsCLAUDE.mdkuafuai/andee/CLAUDE.md
audience.** `README.md` is the **English** front page (what it is, architecture, build, permissions, security). `README.zh-CN.md` is the **Chinese** guide and is the authoritative setup/permissions walkthrough — read it for first-time
fengshao1227Reads credentialsCLAUDE.mdfengshao1227/ccg-workflow/CLAUDE.md
rule 用了错误的 skill 名（#148）**：`ccg-skills.md` 指示 AI 调用不带 `ccg:` 前缀的命令名，但实际注册的命令是 `/ccg:verify-security` 等。AI 按 rule 调用失败后跳过质量关卡。修复：所有引用改为带 `/ccg:` 前缀。 ### 2026-06-18 (v3.1.6) - ✨ **CodeGraph
Steady2 mentions in 2 weeks
No other project uses it yet
fengshao1227CLAUDE.mdfengshao1227/ccg-workflow/templates/CLAUDE.md
docs` | 新建模块 → 生成 README.md + DESIGN.md 骨架 | | `verify-module/` | `/ccg:verify-module` | 模块完成后 → 扫描结构完整性 | | `verify-security/` | `/ccg:verify-security` | 新模块/安全变更/重构 → 漏洞扫描 | | `verify-change/` | `/ccg:verify-change` | >30 行变更 → 文档同步状态分析
Steady2 mentions in 2 weeks
No other project uses it yet
hacdiasCLAUDE.mdhacdias/webdav/.claude/CLAUDE.md
CLAUDE.md Guidance for Claude when working in this repository (`hacdias/webdav`). ## Handling security advisories Advisory state lives on GitHub and is driven with the `gh` CLI: `triage → draft → published`, plus `closed
No other project uses it yet
CountlyCLAUDE.mdCountly/countly-server/CLAUDE.md
plugin tests countly plugin lint name # Lint plugin countly shellcheck # Validate shell scripts ``` ## Critical Security Rules **ALWAYS follow these - no exceptions:** 1. **API endpoints must use validation**: ```javascript const { validateRead
awarexoneCLAUDE.mdawarexone/Agentic-Bug-Hunter/CLAUDE.md
none/confusion/crack), OOB blind-bug confirmation (interactsh), LLM red-team corpus | | `skills/mcp-server-audit/` | MCP server security — tool poisoning, param→sink injection (path/cmd/SSRF/SQL), missing approval gates, result-channel secret leaks, rug-pull/confused-deputy
hieunc229Reads credentialsCLAUDE.mdhieunc229/mailflare/CLAUDE.md
RATE_LIMIT`) since it skips Turnstile. Device keys are listed and revoked under Settings → Security (`/api/devices`), hidden from the API keys list, and `deleteUserSessions` revokes them all (password change, reset
ForeactLabsReads credentialsCLAUDE.mdForeactLabs/OpenExecutive/CLAUDE.md
server/`, auth, `orchestrator/outbound_guard.py`, the cached prompt blocks or `.gitignore` gets a pass from the `security-reviewer` agent (or `/security-review`) before the PR opens. - Every non-draft PR also gets
coleam00CLAUDE.mdcoleam00/ottomator-agents/claude-skill-archon/CLAUDE.md
Include helper scripts**: Python, shell, etc. in `scripts/` - **Use `allowed-tools`**: Restrict tools when security matters - **Show error handling**: Demonstrate proper error patterns - **Add type hints**: Make Python code clear
coleam00Reads credentialsCLAUDE.mdcoleam00/ottomator-agents/livekit-agent/CLAUDE.md
Control**: Pin all dependency versions 6. **Monitor Usage**: Track token usage and costs 7. **Secure Credentials**: Never commit API keys 8. **Document Tools**: Provide clear descriptions for all tools
VercelCLAUDE.mdvercel/streamdown/apps/website/.claude/CLAUDE.md
Prefer simple conditionals over nested ternary operators - Group related code together and separate concerns ### Security - Add `rel="noopener"` when using `target="_blank"` on links - Avoid `dangerouslySetInnerHTML` unless absolutely necessary
Steady8 mentions in 2 weeks
No other project uses it yet
alibabaCLAUDE.mdalibaba/QLExpress/CLAUDE.md
QLInstruction` 子类 | | **数据体系** | `runtime/data/` | 值类型和类型转换 | `Value`, `DataValue`, `ObjTypeConvertor` | | **上下文** | `runtime/context/` | 脚本执行环境 | `ExpressContext`, 多种实现 | | **安全策略** | `security/` | 反射安全隔离 | `QLSecurityStrategy`, 4 种策略 | | **执行追踪** | `runtime/trace/` | 表达式执行路径记录 | `ExpressionTrace`, `TracePointTree` | --- ## 3. 主要的包和类的组织方式 ### 3.1 分层结构 ``` 表现层
GitHubReads credentialsCLAUDE.mdgithub/gh-aw/docs/src/content/docs/reference/engines/claude.md
Claude Code engine configuration, supported tools, runtime behavior, and limitations.
zenml-ioCLAUDE.mdzenml-io/zenml/CLAUDE.md
reuse opportunities, quality issues, and efficiency improvements. Fix any issues it finds before committing. ### Security Guidelines - **NEVER** commit secrets, API keys, tokens, or passwords - Use environment variables or ZenML
zenml-ioReads credentialsCLAUDE.mdzenml-io/zenml/.github/CLAUDE.md
linting.yml, spellcheck.yml, zizmor.yml, check-links.yml, check-markdown-links.yml, gitbook-redirect-check.yml, validate-changelog.yml | Code quality, docs links, changelog, and workflow security checks | | **Release/Nightly** | release.yml, release_prepare.yml, release_finalize.yml, publish_*.yml, nightly_build.yml | PyPI, Docker, Helm, stack template, and nightly
A file Claude Code reads at the start of every session. It holds the commands, conventions and warnings the agent needs for this project.
At the repository root. Claude Code also reads CLAUDE.md files in subdirectories when it works there.
Build and test commands, the project's layout, conventions that aren't obvious from the code, and mistakes to avoid. Short files tend to work better than long ones.
Claude Code reads CLAUDE.md; most other agents read AGENTS.md. Many projects keep one and point the other at it.
