CLAUDE.md examples from real projects

webdatasetCLAUDE.md

webdataset

webdataset/webdataset/CLAUDE.md

src/webdataset/` - Tests in `tests/` ## Code Analysis Guidelines - When analyzing code for issues like security vulnerabilities, focus only on code in `src/webdataset/` - Exclude test files (`tests/`), build scripts (`tasks.py`), and helper

No other project uses it yet

power721CLAUDE.md

alist-tvbox

power721/alist-tvbox/CLAUDE.md

Offline Download - 115 / Guangya / Thunder handlers ### Embedded AList - subprocess runtime - WebDAV proxy (/dav/) --- # 3. Security Model - X-API-KEY → CLIENT - Basic Auth → legacy APIs - Authorization → session tokens Roles: - ADMIN - USER

coderCLAUDE.md

claudecode.nvim

coder/claudecode.nvim/CLAUDE.md

base64, SHA-1, XOR operations in pure Lua #### Authentication System The WebSocket server implements secure authentication using: - **128-bit Tokens**: 32-char lowercase hex from the OS CSPRNG, generated

No other project uses it yet

stravuCLAUDE.md

crystal

stravu/crystal/CLAUDE.md

processes - **Git Integration**: Command-line git worktree management ### Communication - **Electron IPC**: Secure inter-process communication for all operations - **Event System**: IPC-based event handling for real-time updates ## Architecture ```javascript

chatermCLAUDE.md

Chaterm

chaterm/Chaterm/CLAUDE.md

tool with intelligent command completion, multi-device management, AI Agent capabilities, and enterprise-grade security. **Tech Stack:** Vue 3 + TypeScript + Pinia + Ant Design Vue + Monaco Editor + xterm.js + Electron 30 + better

sveltiaCLAUDE.md

sveltia-cms

sveltia/sveltia-cms/CLAUDE.md

/code-review --fix` repeatedly until it reports no findings. - Also run `/security-review` to check for security issues if the change touches a backend, API client, integration, or any code that handles

No other project uses it yet

6Kmfi6HPCLAUDE.md

EDtunnel

6Kmfi6HP/EDtunnel/CLAUDE.md

query parameters can override: `proxyip`, `socks5` (UUID cannot be overridden for security). ## Key Implementation Details - Uses Cloudflare's `cloudflare:sockets` for TCP connections - VLESS protocol version 0 with WebSocket transport

tobychuiCLAUDE.md

arozos

tobychui/arozos/CLAUDE.md

license of each new dependency before merging. ### 4. New endpoints get the right security control Register authenticated endpoints through the permission router, not raw `http.HandleFunc`, so they inherit login

CanineHQCLAUDE.md

canine

CanineHQ/canine/CLAUDE.md

spec/models/user_spec.rb:42 ``` ### Code Quality ```bash # Ruby linting bin/rubocop # Auto-fix linting issues bin/rubocop -a # Security scanning bin/brakeman ``` ### Database ```bash # Run migrations rails db:migrate # Reset test database rails db:test

DarkaOnLineCLAUDE.md

L5-Swagger

DarkaOnLine/L5-Swagger/CLAUDE.md

base path as a Server URL 5. `saveJson()` — writes JSON, then `SecurityDefinitions::generate()` injects security schemes 6. `makeYamlCopy()` — optional YAML conversion via `symfony/yaml` Custom processors can be positioned relative

No other project uses it yet

kaitrannttCLAUDE.md

ccs

kaitranntt/ccs/CLAUDE.md

stable source link is enough. Update the owning documentation when behavior, commands, setup, architecture, security posture, or maintainer workflow changes. Remove stale claims instead of preserving them as TODOs. ## User

No other project uses it yet

compozyCLAUDE.md

compozy / internal

compozy/compozy/internal/CLAUDE.md

changed invariant; keep status-plus-body assertions and the project coverage floor. ## Security - Raw claim tokens, MCP auth tokens, OAuth codes, PKCE verifiers, and bound secrets stay out of logs

No other project uses it yet

szTheoryCLAUDE.md

exifcleaner

szTheory/exifcleaner/CLAUDE.md

throw Error objects in main - **Platform code**: guard with `isMac()` / `isWindows()` / `isLinux()` from `common/platform.ts` - **Security**: always use `sanitize()` from `renderer/sanitize.ts` for exiftool output (XSS prevention) - **i18n**: add translations to `.resources/strings.json

ComplianceAsCodeCLAUDE.md

content

ComplianceAsCode/content/.claude/CLAUDE.md

specific rules (fastest, for testing individual rules) ./build_product ocp4 --rule-id api_server_tls_security_profile ``` Build output goes to `build/`. The data stream file is at: `build/ssg- -ds.xml

useautumnCLAUDE.md

autumn

useautumn/autumn/.claude/CLAUDE.md

this. Use full words. Example: `cusProduct` -> `customerProduct`. Widely accepted conventions like `ctx` are acceptable. ### Security - Add `rel="noopener"` when using `target="_blank"` on links - Avoid `dangerouslySetInnerHTML` unless absolutely necessary

No other project uses it yet

cexllCLAUDE.md

myclaude / memorys

cexll/myclaude/memorys/CLAUDE.md

upfront plan. Construct a private rubric with at least five categories (maintainability, performance, security, style, documentation, backward compatibility). Evaluate the work before finalizing; revisit the implementation if any category misses

mas-bandwidthCLAUDE.md

yojimbo

mas-bandwidth/yojimbo/CLAUDE.md

failure is handled on essentially every path** deliberately, because this is a game server. SECURITY: yojimbo 1.6.3 and earlier vendor a netcode missing the AEAD nonce-reuse fix (netcode

addyosmaniCLAUDE.md

web-quality-skills

addyosmani/web-quality-skills/CLAUDE.md

accessibility | `skills/accessibility/` | "a11y", "WCAG", "accessible" | | seo | `skills/seo/` | "SEO", "meta tags", "search" | | best-practices | `skills/best-practices/` | "security", "best practices", "modern" | ### Key thresholds **Core Web Vitals (Good):** - LCP ≤ 2.5s - INP ≤ 200ms

No other project uses it yet

unpollerCLAUDE.md

unpoller

unpoller/unpoller/CLAUDE.md

Device Type Support Each output plugin has device-specific files: - `uap.go` - Access Points - `usg.go` - Security Gateways - `usw.go` - Switches - `udm.go` - Dream Machines - `uxg.go` - Next-Gen Gateways - `ubb.go` - Building Bridges - `uci.go` - Industrial

No other project uses it yet

iliusCLAUDE.md

pyglossary

ilius/pyglossary/CLAUDE.md

commonly ignored but is not already tracked, ask before committing it. - Never publish a security advisory unless the user explicitly asks to publish it. ## Quality checks