CLAUDE.md examples from real projects

corazawafCLAUDE.md

coraza

corazawaf/coraza/CLAUDE.md

AGENTS.md](AGENTS.md). Read it before making changes; the testing, ADR, pull request and security sections are mandatory. @AGENTS.md

openrewriteCLAUDE.md

rewrite

openrewrite/rewrite/CLAUDE.md

local Maven repository ./gradlew publishToMavenLocal # Apply license headers to files ./gradlew licenseFormat # Run security vulnerability check ./gradlew dependencyCheck ``` ### Running Single Tests ```bash # Test specific module ./gradlew :rewrite-java:test # Test

matt1398CLAUDE.md

claude-devtools / src

matt1398/claude-devtools/src/CLAUDE.md

Structure Three-process Electron architecture: ## Processes - `main/` - Node.js runtime (file system, IPC, lifecycle) - `preload/` - Secure bridge (contextBridge API) - `renderer/` - React/Chromium (UI, state, visualization) - `shared/` - Cross-process types and utilities ## Import

visualboyadvance-mDeletes or force-pushesCLAUDE.md

visualboyadvance-m

visualboyadvance-m/visualboyadvance-m/CLAUDE.md

hardened runtime under `UPSTREAM_RELEASE`, ad-hoc otherwise). Sandbox-awareness lives in `src/wx/macsandbox.mm` (security-scoped bookmarks for recent ROMs, picked directories; battery saves default to ` /Saves` and a picked BIOS

samberPipes a download into a shellCLAUDE.md

cc-skills-golang

samber/cc-skills-golang/CLAUDE.md

goreleaser:*)` | CI/CD or release skills | | `Bash(gh:*)` | Git or GitHub-related skills | | `Bash(govulncheck:*)` | Security or dependency management skills | | `Bash(curl:*)` | API testing or GraphQL skills | | `WebFetch` | Library-specific skills

No other project uses it yet

bytebaseReads credentialsCLAUDE.md

dbhub

bytebase/dbhub/CLAUDE.md

connection pool + buffer cache metrics tool (Postgres/MySQL/MariaDB/SQL Server/Oracle) ├── utils/ # Shared utilities │ ├── dsn-obfuscator.ts# DSN security │ ├── response-formatter.ts # Output formatting │ ├── allowed-keywords.ts # Read-only SQL classification primitives │ ├── result-columns.ts # Unique column names for result rows

robusta-devReads credentialsCLAUDE.md

holmesgpt

robusta-dev/holmesgpt/CLAUDE.md

reverting only the file you noticed leaves the others still acting on the model. ## Security Notes - All tools have read-only access by design - Bash toolset validates commands for safety

FasterXMLCLAUDE.md

jackson-databind

FasterXML/jackson-databind/CLAUDE.md

Backport Policy Which changes each line accepts as a direct target: - `2.18` - Security fixes ONLY - `2.21` - Security or critical fixes only - `3.1` - Security and critical fixes, plus some safe correctness

sozu-proxyCLAUDE.md

sozu

sozu-proxy/sozu/CLAUDE.md

crate, moonpool-driven), and **regression guards** (`lib/tests/log_layout.rs`). E2E suites (non-exhaustive): `h2_tests.rs` + `h2_correctness_tests.rs` + `h2_security_{tests,parser,session,sni,header_injection}.rs` + `h2_priority_rearm_tests.rs` (~181 H2 tests); `mux_tests.rs` (H1 + proxy-protocol

nextlevelbuilderReads credentialsCLAUDE.md

goclaw

nextlevelbuilder/goclaw/CLAUDE.md

JSON5 at `GOCLAW_CONFIG` env. Secrets in `.env.local` or env vars, never in config.json - **Security:** Rate limiting, input guard (detection-only), CORS, shell deny patterns, SSRF protection, path traversal prevention

ExTVCLAUDE.md

Podroid

ExTV/Podroid/CLAUDE.md

averages about 3x, so the backing store stays well under RAM). `CONFIG_EXT4_FS_SECURITY=y` + `CONFIG_SQUASHFS_XATTR=y` keep `security.capability` xattrs across the overlay (rootless podman's `newuidmap

edtechreCLAUDE.md

pybroker

edtechre/pybroker/CLAUDE.md

checkout; `.github/scripts/asv_gate.py` makes the benchmark block/pass decision (see above). - **Workflow security is gated by two tools, not by a script.** The `workflow-audit` job in both `main.yml` and `schedule.yml` runs

RunMaestroReads credentialsCLAUDE.md

Maestro

RunMaestro/Maestro/CLAUDE.md

# CLAUDE.md Essential guidance for working with this codebase. For detailed architecture, see [ARCHITECTURE.md](ARCHITECTURE.md

pedramaminiReads credentialsCLAUDE.md

Maestro

pedramamini/Maestro/CLAUDE.md

# CLAUDE.md Essential guidance for working with this codebase. For detailed architecture, see [ARCHITECTURE.md](ARCHITECTURE.md

chrisvelReads credentialsCLAUDE.md

tududi

chrisvel/tududi/CLAUDE.md

HTTP transport modes - Claude Desktop, Cursor, VS Code configuration - API token authentication and security 24. **[PWA & Offline Support](docs/15-pwa.md)** - Installable as a Progressive Web App (home screen on mobile

No other project uses it yet

lmnr-aiReads credentialsCLAUDE.md

lmnr

lmnr-ai/lmnr/CLAUDE.md

Before working in one of these areas, read the matching file** — it documents invariants, security boundaries, and gotchas that are not inferable from the code: | File | Read when touching | |---|---| | `docs/internal/rust-best-practices.md

QDataCLAUDE.md

TextAttack

QData/TextAttack/CLAUDE.md

/3.9 (pytest currently skipped in CI) - `publish-to-pypi.yml` - PyPI publishing - `make-docs.yml` - Documentation build - `codeql-analysis.yml` - Security analysis ### Test Structure Tests are in `tests/` organized by feature: - `test_command_line/` - CLI command integration

hi-godotCLAUDE.md

godot-ai

hi-godot/godot-ai/.claude/CLAUDE.md

Self-update, migration capsule, or release verification changes | [docs/self-update.md](../docs/self-update.md) | | Undo patterns, readiness, WS security | [docs/plugin-architecture.md](../docs/plugin-architecture.md) | | Repairing or sharing a worktree | [docs/worktrees.md](../docs/worktrees.md) | | Adding an MCP client descriptor | [docs/client-configuration.md

Intelligent-InternetCLAUDE.md

ii-agent

Intelligent-Internet/ii-agent/CLAUDE.md

everywhere** -- never use bare `= Depends(get_x)` in function signatures (exception: `credentials: HTTPAuthorizationCredentials = Depends(security)` in auth). 3. **Import Dep aliases** from other domains instead of importing their factory functions

haydenbleaselCLAUDE.md

ultracite

haydenbleasel/ultracite/.claude/CLAUDE.md

separate concerns - Avoid import cycles; move shared code into a module both sides import ### Security - Add `rel="noopener noreferrer"` when using `target="_blank"` on links - Avoid `dangerouslySetInnerHTML` unless absolutely necessary

No other project uses it yet