CLAUDE.md examples from real projects

FlorianBruniauxCLAUDE.md

claude-code-ultimate-guide

FlorianBruniaux/claude-code-ultimate-guide/CLAUDE.md

printable summary ├── cowork.md # Cowork redirect page ├── core/ # Architecture, methodologies, releases, known-issues, visual-reference ├── security/ # security-hardening, sandbox-isolation, sandbox-native, production-safety, data-privacy ├── ecosystem/ # ai-ecosystem, mcp-servers

rivet-devDeletes or force-pushesCLAUDE.md

engine

rivet-dev/engine/CLAUDE.md

actor-local Unix socket as a trusted, application-local peer, not an adversarial security boundary. Socket ownership, permissions, and per-generation lifetime provide isolation. Continue enforcing framing, resource bounds, cancellation

rivet-devCLAUDE.md

engine / rivetkit-typescript

rivet-dev/engine/rivetkit-typescript/CLAUDE.md

date in the same change whenever dynamic actor architecture, lifecycle, bridge payloads, security behavior, or temporary compatibility paths change

Q00CLAUDE.md

ouroboros

Q00/ouroboros/CLAUDE.md

introduced by this PR? 5. If scope is split, does immediate user-data or security risk remain? Use these decisions: - Q1 + Q2: **Changes Requested**. - Q3 + Q5: stop and revisit

No other project uses it yet

wiltodeltaCLAUDE.md

remove-ai-watermarks

wiltodelta/remove-ai-watermarks/CLAUDE.md

binding registry snapshot is stale; rerun it without `--check` to refresh the snapshot. Triaged security blocks and their recheck procedure, environment recovery, CI behavior, and fixture policy live in [`docs/development.md

appleboyCLAUDE.md

ssh-action

appleboy/ssh-action/CLAUDE.md

Docker containers (tests `./` local action) - `.github/workflows/stable.yml` - Tests against published `appleboy/ssh-action@v1` tag - `.github/workflows/trivy-scan.yml` - Automated security scanning for vulnerabilities and misconfigurations ## Testing ### Running Tests Tests run automatically via GitHub Actions workflows

No other project uses it yet

HeliconeCLAUDE.md

helicone

Helicone/helicone/CLAUDE.md

useJawnClient()` ### Database - PostgreSQL with snake_case naming - ClickHouse for analytics - Proper RLS policies for security ## Tech Stack ### Frontend - Next.js 14 with React 18.3.1 - TypeScript, Tailwind CSS, Radix UI - Zustand

No other project uses it yet

lightdashCLAUDE.md

lightdash

lightdash/lightdash/CLAUDE.md

assertUnreachable } from '@lightdash/common';` - This provides compile-time safety when new union members are added ## Security Best Practices ### Installing Dependencies — Always Use `sfw` Prefix every package-manager install with [Socket Firewall

No other project uses it yet

eberttiCLAUDE.md

awesome-telegram

ebertti/awesome-telegram/CLAUDE.md

links) - The entry is a crypto trading bot that requests API keys via Telegram (security risk) - The content appears to be self-promotion of paid/adult/gated content groups - The PR title

apacheCLAUDE.md

pinot

apache/pinot/CLAUDE.md

requested full reviews and changes that benefit from independent domain review, especially compatibility, concurrency, security, and distributed state changes. Small changes can be reviewed directly. Reuse review evidence while

No other project uses it yet

bethingtonReads credentialsCLAUDE.md

ghidra-mcp

bethington/ghidra-mcp/CLAUDE.md

anyone's issue/PR/comment text, never touch draft PRs, never merge around a contributor, and security reports / hostile threads / anything reputational default to "Ben posts personally" unless he explicitly chooses agent

fengshao1227Reads credentialsCLAUDE.md

ccg-workflow

fengshao1227/ccg-workflow/CLAUDE.md

rule 用了错误的 skill 名（#148）**：`ccg-skills.md` 指示 AI 调用不带 `ccg:` 前缀的命令名，但实际注册的命令是 `/ccg:verify-security` 等。AI 按 rule 调用失败后跳过质量关卡。修复：所有引用改为带 `/ccg:` 前缀。 ### 2026-06-18 (v3.1.6) - ✨ **CodeGraph

No other project uses it yet

fengshao1227CLAUDE.md

ccg-workflow / templates

fengshao1227/ccg-workflow/templates/CLAUDE.md

docs` | 新建模块 → 生成 README.md + DESIGN.md 骨架 | | `verify-module/` | `/ccg:verify-module` | 模块完成后 → 扫描结构完整性 | | `verify-security/` | `/ccg:verify-security` | 新模块/安全变更/重构 → 漏洞扫描 | | `verify-change/` | `/ccg:verify-change` | >30 行变更 → 文档同步状态分析

No other project uses it yet

hacdiasCLAUDE.md

webdav

hacdias/webdav/.claude/CLAUDE.md

CLAUDE.md Guidance for Claude when working in this repository (`hacdias/webdav`). ## Handling security advisories Advisory state lives on GitHub and is driven with the `gh` CLI: `triage → draft → published`, plus `closed

No other project uses it yet

CountlyCLAUDE.md

countly-server

Countly/countly-server/CLAUDE.md

plugin tests countly plugin lint name # Lint plugin countly shellcheck # Validate shell scripts ``` ## Critical Security Rules **ALWAYS follow these - no exceptions:** 1. **API endpoints must use validation**: ```javascript const { validateRead

coleam00CLAUDE.md

ottomator-agents / claude-skill-archon

coleam00/ottomator-agents/claude-skill-archon/CLAUDE.md

Include helper scripts**: Python, shell, etc. in `scripts/` - **Use `allowed-tools`**: Restrict tools when security matters - **Show error handling**: Demonstrate proper error patterns - **Add type hints**: Make Python code clear

coleam00Reads credentialsCLAUDE.md

ottomator-agents / livekit-agent

coleam00/ottomator-agents/livekit-agent/CLAUDE.md

Control**: Pin all dependency versions 6. **Monitor Usage**: Track token usage and costs 7. **Secure Credentials**: Never commit API keys 8. **Document Tools**: Provide clear descriptions for all tools

VercelCLAUDE.md

streamdown / website

vercel/streamdown/apps/website/.claude/CLAUDE.md

Prefer simple conditionals over nested ternary operators - Group related code together and separate concerns ### Security - Add `rel="noopener"` when using `target="_blank"` on links - Avoid `dangerouslySetInnerHTML` unless absolutely necessary

No other project uses it yet

SenteLabsAIReads credentialsCLAUDE.md

OpenExecutive

SenteLabsAI/OpenExecutive/CLAUDE.md

server/`, auth, `orchestrator/outbound_guard.py`, the cached prompt blocks or `.gitignore` gets a pass from the `security-reviewer` agent (or `/security-review`) before the PR opens. - Every non-draft PR also gets

alibabaCLAUDE.md

QLExpress

alibaba/QLExpress/CLAUDE.md

QLInstruction` 子类 | | **数据体系** | `runtime/data/` | 值类型和类型转换 | `Value`, `DataValue`, `ObjTypeConvertor` | | **上下文** | `runtime/context/` | 脚本执行环境 | `ExpressContext`, 多种实现 | | **安全策略** | `security/` | 反射安全隔离 | `QLSecurityStrategy`, 4 种策略 | | **执行追踪** | `runtime/trace/` | 表达式执行路径记录 | `ExpressionTrace`, `TracePointTree` | --- ## 3. 主要的包和类的组织方式 ### 3.1 分层结构 ``` 表现层