CLAUDE.md examples from real projects

zenml-ioReads credentialsCLAUDE.md

zenml

zenml-io/zenml/.github/CLAUDE.md

linting.yml, spellcheck.yml, zizmor.yml, check-links.yml, check-markdown-links.yml, gitbook-redirect-check.yml, validate-changelog.yml | Code quality, docs links, changelog, and workflow security checks | | **Release/Nightly** | release.yml, release_prepare.yml, release_finalize.yml, publish_*.yml, nightly_build.yml | PyPI, Docker, Helm, stack template, and nightly

useplunkReads credentialsCLAUDE.md

plunk

useplunk/plunk/CLAUDE.md

Database: `DATABASE_URL`, `DIRECT_DATABASE_URL` (for Prisma client generation) - Standard: `NODE_ENV` **Runtime:** - Security: `JWT_SECRET` - Database: `DATABASE_URL`, `DIRECT_DATABASE_URL` - Infrastructure: `REDIS_URL` - **Application URLs** (injected

aaddrickDeletes or force-pushesCLAUDE.md

claude-desktop-debian

aaddrick/claude-desktop-debian/CLAUDE.md

Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/).** Bullets grouped under Added / Fixed / Changed / Deprecated / Removed / Security; one bullet per change; PR link for the deep dive; inline **BREAKING** prefix for breaking changes

0xebCLAUDE.md

TheBigPromptLibrary

0xeb/TheBigPromptLibrary/.claude/CLAUDE.md

content is primarily markdown documentation for educational purposes around prompt engineering and LLM security research. ## Repository Structure - **SystemPrompts/** - System prompts from various LLM providers (OpenAI, Anthropic, Google, Meta

SaladDayReads credentialsCLAUDE.md

cc-switch-cli

SaladDay/cc-switch-cli/CLAUDE.md

writes to live app configuration files, proxy routing or failover, concurrency, credentials or other security-sensitive paths, or import, export and sync of user data. Every reviewer inspects that round

melgarafaelReads credentialsCLAUDE.md

DeskcommCRM

melgarafael/DeskcommCRM/CLAUDE.md

Extensions: `uuid-ossp`, `pgcrypto`, `vector` - **Auth:** Supabase Auth via `@supabase/ssr`. Cookie SameSite=Strict, HttpOnly, Secure - **Realtime:** Supabase Realtime (postgres_changes + broadcast) - **Storage:** Supabase Storage (bucket `whatsapp-media` privado, URLs assinadas

trustwalletCLAUDE.md

assets

trustwallet/assets/CLAUDE.md

architecture, build, conventions, core-libs, decisions, design, features, git-conventions, guides, observability, product, quality, security, tests, workflows, brand, business, legal, hr, prompts, api, libs, components, references ## Constraints - [TODO: Add project

kasmtechDeletes or force-pushesCLAUDE.md

KasmVNC

kasmtech/KasmVNC/CLAUDE.md

ancestor, but KasmVNC deliberately breaks RFB to support modern transport, encodings, and security. **Do not "fix" code toward RFB-spec compliance** — divergence is intended. (A detailed list of the deviations

spiegltCLAUDE.md

FlyingCarpet

spieglt/FlyingCarpet/CLAUDE.md

never reuse, never user-chosen, never "remember." The entire "offline crack is worthless" security argument depends on this (see the crypto doc §7). The discovery HMAC key is derived from

breaking-brakeCLAUDE.md

cc-wf-studio

breaking-brake/cc-wf-studio/CLAUDE.md

effect refactors) is out of scope for agents. Maintenance is interrupt-only: red CI, security, human-reported bugs. - Two skills drive it: `next-idea` (ideation — files locked `idea` issues, never

entireioCLAUDE.md

cli

entireio/cli/CLAUDE.md

docs/architecture/agent-guide.md), [integration checklist](docs/architecture/agent-integration-checklist.md) | | External commands or agents | [External commands](docs/architecture/external-commands.md), [agent protocol](docs/architecture/external-agent-protocol.md) | | Security, privacy, scanners | [Security and privacy](docs/security-and-privacy.md), [implementation contracts](docs/development/checkpoint-implementation.md) | | Review command | [Review architecture](docs/architecture/review-command.md) | | Release

umbracoCLAUDE.md

Umbraco-CMS

umbraco/Umbraco-CMS/CLAUDE.md

APIs use **OpenIddict** (OAuth 2.0/OpenID Connect): - Reference tokens (not JWT) for better security - **Secure cookie-based token storage** (v17+) - tokens stored in HTTP-only cookies with `__Host-` prefix - Tokens

nibzardCLAUDE.md

awesome-agentic-patterns

nibzard/awesome-agentic-patterns/CLAUDE.md

Original Creator (Source)"] category: "Orchestration & Control | Context & Memory | Feedback Loops | Learning & Adaptation | Reliability & Eval | Security & Safety | Tool Use & Environment | UX & Collaboration | Uncategorized" source: "URL to primary source" tags: [relevant, keywords

pdfmeDeletes or force-pushesCLAUDE.md

pdfme

pdfme/pdfme/CLAUDE.md

only display - `form`: Interactive input - `designer`: Template creation Base class: `packages/ui/src/class.ts` #### 5. Expression System Secure JavaScript expression evaluator for dynamic content: - Uses Acorn for parsing - AST validation for security - Cached

No other project uses it yet

SadeghHayeriDeletes or force-pushesCLAUDE.md

GreenTunnel

SadeghHayeri/GreenTunnel/CLAUDE.md

service configured with just one of the two. Entries now carry a separate `secure` endpoint. 6. **No crash-safety whatsoever.** `SIGKILL`, a force-quit or a `npm run dev` reload

rivet-devCLAUDE.md

agent-os

rivet-dev/agent-os/CLAUDE.md

enter default builds, CI, publication, or behavioral-parity requirements without a separately approved design. ## Security Model Trust model: - **Client**: trusted, except for code/payloads it submits for execution. - **Sidecar/runtime**: trusted enforcement

rivet-devReads credentialsCLAUDE.md

agent-os / crates

rivet-dev/agent-os/crates/CLAUDE.md

architectural invariant. Any path where guest code reaches the real host is a critical security violation. **NEVER use `Command::new("node")` for guest code execution.** Guest JavaScript runs inside

SaffsanityCLAUDE.md

sill

Saffsanity/sill/CLAUDE.md

other languages and dictation (#147), the thumbnail hold (#248), Aa's Off (#181), the security fixes of 2026-10-29, the tour once more and a locked

ruvnetReads credentialsCLAUDE.md

ruvector

ruvnet/ruvector/CLAUDE.md

lint ``` - ALWAYS run tests after making code changes - ALWAYS verify build succeeds before committing ## Security Rules - NEVER hardcode API keys, secrets, or credentials in source files - NEVER commit .env files

JetBrainsCLAUDE.md

koog / a2a

JetBrains/koog/a2a/CLAUDE.md

task updates - **Multiple Transport Protocols**: JSON-RPC, HTTP+JSON/REST with extensibility for gRPC - **Authentication & Security**: OpenAPI 3.0 compatible security schemes ### Submodules Architecture 1. **a2a-core**: Core abstractions, data models

No other project uses it yet