CLAUDE.md examples from real projects

hzqstCLAUDE.md

VmwareHardenedLoader

hzqst/VmwareHardenedLoader/.claude/CLAUDE.md

navigation points needed for discovery: - Project purpose, source map, driver lifecycle, and dynamic-data security model: `core`. - Toolchain, System Informer dependency, and generated outputs: `tech_stack`. - Build and runtime commands

FasterXMLCLAUDE.md

jackson-core

FasterXML/jackson-core/CLAUDE.md

configuration flows through `TSFBuilder` / `JsonFactoryBuilder`. There is no mutable-setter fallback. ### Processing limits (security-relevant) Three per-factory config objects, with quite different scopes — don't conflate them: - **`StreamReadConstraints`** does

No other project uses it yet

levy-streetCLAUDE.md

world-of-claudecraft

levy-street/world-of-claudecraft/docs/CLAUDE.md

iOS/Android). Living. | | `sfx-studio-tutorial.md`, `codex.md` | Operator guides: the SFX Studio; the Codex support layer. Living. | | `security/` | `malware-scan-catalog.md`: the path-aware triage priors behind `scripts/malware_scan.mjs --gate`. `dependency-audit-catalog.md`: the `pnpm audit` gate model

levy-streetCLAUDE.md

world-of-claudecraft / tests

levy-street/world-of-claudecraft/tests/CLAUDE.md

means touching this file. - SFX gates: the `sfx_*` suites (`sfx_conform`, `sfx_studio_server_security`, `tests/server/static_sfx_serving`, ...) mirror `npm run sfx:check`. - `malware_scan.test.ts` is the release-gate backstop (signatures from `scripts/malware_scan.mjs

zakirkunCLAUDE.md

deep-eye

zakirkun/deep-eye/CLAUDE.md

builders | | `.agents/skills/` | Agent skills: pentest, bug-bounty, red-team, blue-team, ctf, security-ops | ### Agent skills When the user asks for pentest / bug bounty / red team / blue team / CTF work

stacklokCLAUDE.md

toolhive

stacklok/toolhive/CLAUDE.md

Claude Code when working with this repository. ## Project Overview ToolHive is a lightweight, secure manager for MCP (Model Context Protocol: https://modelcontextprotocol.io) servers written in Go. It provides

No other project uses it yet

josephburnettCLAUDE.md

jd

josephburnett/jd/CLAUDE.md

/lib` - Deprecated v1 library (read-only) - `main.go` - Deprecated v1 commandline (read-only) ## Supply Chain Security - Dependencies MUST be minimal. Do not add new dependencies without justification. - GitHub Actions MUST

mampfesCLAUDE.md

hacs_waste_collection_schedule

mampfes/hacs_waste_collection_schedule/CLAUDE.md

contributor's branch and approve. Hardcoded data, missing API integration, security issues → request changes. - **Never commit directly to `master`** — local, origin, or upstream. Every change goes through a feature branch

No other project uses it yet

salesforceCLAUDE.md

cloudsplaining

salesforce/cloudsplaining/CLAUDE.md

working with code in this repository. ## What This Is Cloudsplaining is an AWS IAM security assessment tool. It parses the output of `aws iam get-account-authorization-details`, identifies

0-AI-UGCLAUDE.md

cate

0-AI-UG/cate/CLAUDE.md

kernel/`: rpc, api, settings, lifecycle, state, log, interaction (generic machinery) - `runtime/`: daemon, data, transports, security, pairing, connect, tunnel, power, push - `workspace/`: document, lifecycle (trust), canvas, files, repository, skills, relations, notifications

No other project uses it yet

atomicmemoryCLAUDE.md

llm-wiki-compiler

atomicmemory/llm-wiki-compiler/docs/CLAUDE.md

config, environment variables, providers, SDK/MCP surfaces, viewer behavior, export/import formats, files written under `.llmwiki/`, security boundaries, and changed failure behavior. - Prefer updating the closest existing page. Add a new page

StripeCLAUDE.md

stripe-cli

stripe/stripe-cli/CLAUDE.md

rather than `/tmp` — `bin/` is gitignored and within the project's trusted directory. macOS security may block execution of binaries built outside the project tree. ## Project Structure - `cmd/stripe/main.go` - Entry point

No other project uses it yet

SilentelyCLAUDE.md

eSIM-Tools / scripts

Silentely/eSIM-Tools/scripts/CLAUDE.md

脚本 | 命令 | 职责 | |------|------|------| | `quality-check.js` | `npm run quality-check` | 代码质量检查 (14 项) | | `security-check.js` | `npm run security-check` | 安全配置扫描 | ### 部署相关 | 脚本 | 命令 | 职责 | |------|------|------| | `deploy-prepare.js` | `npm run deploy-prepare` | 部署准备 (质量+安全+构建

SilentelyCLAUDE.md

eSIM-Tools / tests

Silentely/eSIM-Tools/tests/CLAUDE.md

Logger | 日志输出与脱敏 | | | `utils.test.js` | Utils | 工具函数 (debounce/throttle 等) | | | `html-sanitizer.test.js` | HTML Sanitizer | XSS 防护 (escapeHtml/escapeAttr) | | | `secure-storage.test.js` | Secure Storage | 加密 localStorage (TTL 过期) | | | `api-service.test.js` | API Service | HTTP 客户端 (重试/缓存/去重) | | **simyo/** | `help.test.js

joshuayoesCLAUDE.md

ios-simulator-mcp

joshuayoes/ios-simulator-mcp/CLAUDE.md

xcrun simctl` and Facebook's `idb` commands - Validates all inputs with Zod schemas - Implements security best practices with `--` argument separation - Supports environment-based tool filtering via `IOS_SIMULATOR_MCP_FILTERED

yakhyoCLAUDE.md

uniface

yakhyo/uniface/CLAUDE.md

full suite before submitting changes. ## Pre-commit Pre-commit hooks handle formatting, linting, security checks, and notebook output stripping. Always run: ```bash pre-commit install pre-commit run --all-files

photon-hqCLAUDE.md

spectrum-ts

photon-hq/spectrum-ts/.claude/CLAUDE.md

Prefer simple conditionals over nested ternary operators - Group related code together and separate concerns ### Security - Add `rel="noopener"` when using `target="_blank"` on links - Avoid `dangerouslySetInnerHTML` unless absolutely necessary

opensearch-projectCLAUDE.md

OpenSearch-Dashboards

opensearch-project/OpenSearch-Dashboards/CLAUDE.md

with autofix node scripts/eslint --fix # Type check yarn typecheck # Run Cypress functional tests (no security plugin) yarn cypress:run-without-security # Run a specific Cypress test yarn cypress:run-without

ipxeCLAUDE.md

ipxe

ipxe/ipxe/CLAUDE.md

AGENTS.md`](AGENTS.md) — follow them. This file adds only the Claude Code-specific pieces. - **Security review:** for vulnerability-hunting work, invoke the **ipxe-security-review** skill (`.claude/skills/ipxe-security-review/`). It encodes the sweep

WuKongOpenSourceCLAUDE.md

AI_CRM

WuKongOpenSource/AI_CRM/CLAUDE.md

enabled` 默认 `false`。同一用户重新登录会写 kickout 标记并删除旧令牌，旧令牌的后续请求随即失效；置 `true` 放开多端并发登录。 - **每请求生命周期**：校验令牌 → 写入 Spring Security 上下文与 `TenantContextHolder` → 在 `finally` 中**同时**清理 `TenantContextHolder` 与 `DataPermissionHolder`（线程池复用时防 ThreadLocal 泄漏）。无请求上下文的代码（注册