CLAUDE.md examples from real projects

GitHubReads credentialsCLAUDE.md

gh-aw / engines

github/gh-aw/docs/src/content/docs/reference/engines/claude.md

Claude Code engine configuration, supported tools, runtime behavior, and limitations.

shuvonsecCLAUDE.md

claude-bug-bounty

shuvonsec/claude-bug-bounty/CLAUDE.md

none/confusion/crack), OOB blind-bug confirmation (interactsh), LLM red-team corpus | | `skills/mcp-server-audit/` | MCP server security — tool poisoning, param→sink injection (path/cmd/SSRF/SQL), missing approval gates, result-channel secret leaks, rug-pull/confused-deputy

aaddrickDeletes or force-pushesCLAUDE.md

claude-desktop-debian

aaddrick/claude-desktop-debian/CLAUDE.md

Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/).** Bullets grouped under Added / Fixed / Changed / Deprecated / Removed / Security; one bullet per change; PR link for the deep dive; inline **BREAKING** prefix for breaking changes

0xebCLAUDE.md

TheBigPromptLibrary

0xeb/TheBigPromptLibrary/.claude/CLAUDE.md

content is primarily markdown documentation for educational purposes around prompt engineering and LLM security research. ## Repository Structure - **SystemPrompts/** - System prompts from various LLM providers (OpenAI, Anthropic, Google, Meta

SaladDayReads credentialsCLAUDE.md

cc-switch-cli

SaladDay/cc-switch-cli/CLAUDE.md

rounds. Ask the reviewer to independently inspect all current modifications and report correctness, regression, security, performance, UX, and test-coverage issues. - Validate every finding against the code. Make minimal fixes

No other project uses it yet

trustwalletCLAUDE.md

assets

trustwallet/assets/CLAUDE.md

architecture, build, conventions, core-libs, decisions, design, features, git-conventions, guides, observability, product, quality, security, tests, workflows, brand, business, legal, hr, prompts, api, libs, components, references ## Constraints - [TODO: Add project

breaking-brakeCLAUDE.md

cc-wf-studio

breaking-brake/cc-wf-studio/CLAUDE.md

effect refactors) is out of scope for agents. Maintenance is interrupt-only: red CI, security, human-reported bugs. - Two skills drive it: `next-idea` (ideation — files locked `idea` issues, never

No other project uses it yet

spiegltCLAUDE.md

FlyingCarpet

spieglt/FlyingCarpet/CLAUDE.md

never reuse, never user-chosen, never "remember." The entire "offline crack is worthless" security argument depends on this (see the crypto doc §7). The discovery HMAC key is derived from

kasmtechDeletes or force-pushesCLAUDE.md

KasmVNC

kasmtech/KasmVNC/CLAUDE.md

ancestor, but KasmVNC deliberately breaks RFB to support modern transport, encodings, and security. **Do not "fix" code toward RFB-spec compliance** — divergence is intended. (A detailed list of the deviations

entireioCLAUDE.md

cli

entireio/cli/CLAUDE.md

docs/architecture/agent-guide.md), [integration checklist](docs/architecture/agent-integration-checklist.md) | | External commands or agents | [External commands](docs/architecture/external-commands.md), [agent protocol](docs/architecture/external-agent-protocol.md) | | Security, privacy, scanners | [Security and privacy](docs/security-and-privacy.md), [implementation contracts](docs/development/checkpoint-implementation.md) | | Review command | [Review architecture](docs/architecture/review-command.md) | | Release

No other project uses it yet

umbracoCLAUDE.md

Umbraco-CMS

umbraco/Umbraco-CMS/CLAUDE.md

APIs use **OpenIddict** (OAuth 2.0/OpenID Connect): - Reference tokens (not JWT) for better security - **Secure cookie-based token storage** (v17+) - tokens stored in HTTP-only cookies with `__Host-` prefix - Tokens

hieunc229Reads credentialsCLAUDE.md

mailflare

hieunc229/mailflare/CLAUDE.md

RATE_LIMIT`) since it skips Turnstile. Device keys are listed and revoked under Settings → Security (`/api/devices`), hidden from the API keys list, and `deleteUserSessions` revokes them all (password change, reset

No other project uses it yet

nibzardCLAUDE.md

awesome-agentic-patterns

nibzard/awesome-agentic-patterns/CLAUDE.md

Original Creator (Source)"] category: "Orchestration & Control | Context & Memory | Feedback Loops | Learning & Adaptation | Reliability & Eval | Security & Safety | Tool Use & Environment | UX & Collaboration | Uncategorized" source: "URL to primary source" tags: [relevant, keywords

melgarafaelReads credentialsCLAUDE.md

DeskcommCRM

melgarafael/DeskcommCRM/CLAUDE.md

Extensions: `uuid-ossp`, `pgcrypto`, `vector` - **Auth:** Supabase Auth via `@supabase/ssr`. Cookie SameSite=Strict, HttpOnly, Secure - **Realtime:** Supabase Realtime (postgres_changes + broadcast) - **Storage:** Supabase Storage (bucket `whatsapp-media` privado, URLs assinadas

PerryTSCLAUDE.md

perry

PerryTS/perry/CLAUDE.md

cargo-test`, the 6-shard fast-mode gap suite, `gc-stress`, `e2e-scoped`, and `security-audit` when a lockfile/manifest changed). What runs in which tier is decided by `scripts/ci_plan.py` (`--table

No other project uses it yet

pdfmeDeletes or force-pushesCLAUDE.md

pdfme

pdfme/pdfme/CLAUDE.md

only display - `form`: Interactive input - `designer`: Template creation Base class: `packages/ui/src/class.ts` #### 5. Expression System Secure JavaScript expression evaluator for dynamic content: - Uses Acorn for parsing - AST validation for security - Cached

SadeghHayeriDeletes or force-pushesCLAUDE.md

GreenTunnel

SadeghHayeri/GreenTunnel/CLAUDE.md

service configured with just one of the two. Entries now carry a separate `secure` endpoint. 6. **No crash-safety whatsoever.** `SIGKILL`, a force-quit or a `npm run dev` reload

rivet-devCLAUDE.md

agent-os

rivet-dev/agent-os/CLAUDE.md

enter default builds, CI, publication, or behavioral-parity requirements without a separately approved design. ## Security Model Trust model: - **Client**: trusted, except for code/payloads it submits for execution. - **Sidecar/runtime**: trusted enforcement

rivet-devReads credentialsCLAUDE.md

agent-os / crates

rivet-dev/agent-os/crates/CLAUDE.md

architectural invariant. Any path where guest code reaches the real host is a critical security violation. **NEVER use `Command::new("node")` for guest code execution.** Guest JavaScript runs inside

ruvnetReads credentialsCLAUDE.md

RuVector

ruvnet/RuVector/CLAUDE.md

lint ``` - ALWAYS run tests after making code changes - ALWAYS verify build succeeds before committing ## Security Rules - NEVER hardcode API keys, secrets, or credentials in source files - NEVER commit .env files