CLAUDE.md examples from real projects

SaladDayReads credentialsCLAUDE.md

cc-switch-cli

SaladDay/cc-switch-cli/CLAUDE.md

rounds. Ask the reviewer to independently inspect all current modifications and report correctness, regression, security, performance, UX, and test-coverage issues. - Validate every finding against the code. Make minimal fixes

No other project uses it yet

trustwalletCLAUDE.md

assets

trustwallet/assets/CLAUDE.md

architecture, build, conventions, core-libs, decisions, design, features, git-conventions, guides, observability, product, quality, security, tests, workflows, brand, business, legal, hr, prompts, api, libs, components, references ## Constraints - [TODO: Add project

hieunc229Reads credentialsCLAUDE.md

mailflare

hieunc229/mailflare/CLAUDE.md

RATE_LIMIT`) since it skips Turnstile. Device keys are listed and revoked under Settings → Security (`/api/devices`), hidden from the API keys list, and `deleteUserSessions` revokes them all (password change, reset

spiegltCLAUDE.md

FlyingCarpet

spieglt/FlyingCarpet/CLAUDE.md

never reuse, never user-chosen, never "remember." The entire "offline crack is worthless" security argument depends on this (see the crypto doc §7). The discovery HMAC key is derived from

breaking-brakeCLAUDE.md

cc-wf-studio

breaking-brake/cc-wf-studio/CLAUDE.md

effect refactors) is out of scope for agents. Maintenance is interrupt-only: red CI, security, human-reported bugs. - Two skills drive it: `next-idea` (ideation — files locked `idea` issues, never

No other project uses it yet

kasmtechDeletes or force-pushesCLAUDE.md

KasmVNC

kasmtech/KasmVNC/CLAUDE.md

ancestor, but KasmVNC deliberately breaks RFB to support modern transport, encodings, and security. **Do not "fix" code toward RFB-spec compliance** — divergence is intended. (A detailed list of the deviations

entireioCLAUDE.md

cli

entireio/cli/CLAUDE.md

docs/architecture/agent-guide.md), [integration checklist](docs/architecture/agent-integration-checklist.md) | | External commands or agents | [External commands](docs/architecture/external-commands.md), [agent protocol](docs/architecture/external-agent-protocol.md) | | Security, privacy, scanners | [Security and privacy](docs/security-and-privacy.md), [implementation contracts](docs/development/checkpoint-implementation.md) | | Review command | [Review architecture](docs/architecture/review-command.md) | | Release

No other project uses it yet

umbracoCLAUDE.md

Umbraco-CMS

umbraco/Umbraco-CMS/CLAUDE.md

APIs use **OpenIddict** (OAuth 2.0/OpenID Connect): - Reference tokens (not JWT) for better security - **Secure cookie-based token storage** (v17+) - tokens stored in HTTP-only cookies with `__Host-` prefix - Tokens

nibzardCLAUDE.md

awesome-agentic-patterns

nibzard/awesome-agentic-patterns/CLAUDE.md

Original Creator (Source)"] category: "Orchestration & Control | Context & Memory | Feedback Loops | Learning & Adaptation | Reliability & Eval | Security & Safety | Tool Use & Environment | UX & Collaboration | Uncategorized" source: "URL to primary source" tags: [relevant, keywords

melgarafaelReads credentialsCLAUDE.md

DeskcommCRM

melgarafael/DeskcommCRM/CLAUDE.md

Extensions: `uuid-ossp`, `pgcrypto`, `vector` - **Auth:** Supabase Auth via `@supabase/ssr`. Cookie SameSite=Strict, HttpOnly, Secure - **Realtime:** Supabase Realtime (postgres_changes + broadcast) - **Storage:** Supabase Storage (bucket `whatsapp-media` privado, URLs assinadas

PerryTSCLAUDE.md

perry

PerryTS/perry/CLAUDE.md

cargo-test`, the 6-shard fast-mode gap suite, `gc-stress`, `e2e-scoped`, and `security-audit` when a lockfile/manifest changed). What runs in which tier is decided by `scripts/ci_plan.py` (`--table

No other project uses it yet

pdfmeDeletes or force-pushesCLAUDE.md

pdfme

pdfme/pdfme/CLAUDE.md

only display - `form`: Interactive input - `designer`: Template creation Base class: `packages/ui/src/class.ts` #### 5. Expression System Secure JavaScript expression evaluator for dynamic content: - Uses Acorn for parsing - AST validation for security - Cached

SadeghHayeriDeletes or force-pushesCLAUDE.md

GreenTunnel

SadeghHayeri/GreenTunnel/CLAUDE.md

service configured with just one of the two. Entries now carry a separate `secure` endpoint. 6. **No crash-safety whatsoever.** `SIGKILL`, a force-quit or a `npm run dev` reload

rivet-devCLAUDE.md

agent-os

rivet-dev/agent-os/CLAUDE.md

enter default builds, CI, publication, or behavioral-parity requirements without a separately approved design. ## Security Model Trust model: - **Client**: trusted, except for code/payloads it submits for execution. - **Sidecar/runtime**: trusted enforcement

rivet-devReads credentialsCLAUDE.md

agent-os / crates

rivet-dev/agent-os/crates/CLAUDE.md

architectural invariant. Any path where guest code reaches the real host is a critical security violation. **NEVER use `Command::new("node")` for guest code execution.** Guest JavaScript runs inside

ruvnetReads credentialsCLAUDE.md

RuVector

ruvnet/RuVector/CLAUDE.md

lint ``` - ALWAYS run tests after making code changes - ALWAYS verify build succeeds before committing ## Security Rules - NEVER hardcode API keys, secrets, or credentials in source files - NEVER commit .env files

JetBrainsCLAUDE.md

koog / a2a

JetBrains/koog/a2a/CLAUDE.md

task updates - **Multiple Transport Protocols**: JSON-RPC, HTTP+JSON/REST with extensibility for gRPC - **Authentication & Security**: OpenAPI 3.0 compatible security schemes ### Submodules Architecture 1. **a2a-core**: Core abstractions, data models

No other project uses it yet

prestDeletes or force-pushesCLAUDE.md

prest

prest/prest/.claude/CLAUDE.md

opus"` only for architecture, new dialects, cross-cutting refactors, unknown-root-cause debugging or security-sensitive changes. Escalate only with a stated reason. **Reference:** `.cursor/rules/planning-and-delegation.mdc` ## When to Apply Rules

No other project uses it yet

SupabaseDeletes or force-pushesCLAUDE.md

supabase-js

supabase/supabase-js/.claude/CLAUDE.md

cutting migration notes (one H2 per theme). Per-package migrations live at `packages/core/ /migrations/`. > - **[Security Policy](https://github.com/supabase/supabase-js/security/policy)** - Security policies and responsible disclosure ## Repository Architecture ### Monorepo Structure ```text supabase

bjarneoPipes a download into a shellCLAUDE.md

cliamp

bjarneo/cliamp/CLAUDE.md

make coverage` | Tests with a coverage profile and a summary for each function | | `make security` | `govulncheck ./...` | | `make ci` | What CI runs: `fmt-check`, `tidy-check`, `vet`, `staticcheck`, `security`, race tests