CLAUDE.md examples from real projects

sw33tLieCLAUDE.md

macshot

sw33tLie/macshot/CLAUDE.md

secret filter │ ├── LanguageManager.swift # Locale resolution + L("…") lookup │ ├── ScreenshotHistory.swift # Local history in ~/Library/Application Support/ │ └── SaveDirectoryAccess.swift # Security-scoped bookmark for save directory │ ├── Upload/ │ ├── UploadPayload.swift # Streamed upload bodies (chunking, incremental SHA256, multipart

gadievronCLAUDE.md

raptor

gadievron/raptor/CLAUDE.md

training. --- ## COMMANDS /project - Project management — `libexec/raptor-project-manager [args]` (see PROJECTS) /scan /fuzz /web /codeql /analyze - Security testing — `python3 raptor.py ` /agentic - Scan → dedup → prep → analysis pipeline (exploitation-validator methodology) — `libexec/raptor-agentic --repo `. Optional

matt1398CLAUDE.md

claude-devtools / src

matt1398/claude-devtools/src/CLAUDE.md

Structure Three-process Electron architecture: ## Processes - `main/` - Node.js runtime (file system, IPC, lifecycle) - `preload/` - Secure bridge (contextBridge API) - `renderer/` - React/Chromium (UI, state, visualization) - `shared/` - Cross-process types and utilities ## Import

visualboyadvance-mDeletes or force-pushesCLAUDE.md

visualboyadvance-m

visualboyadvance-m/visualboyadvance-m/CLAUDE.md

hardened runtime under `UPSTREAM_RELEASE`, ad-hoc otherwise). Sandbox-awareness lives in `src/wx/macsandbox.mm` (security-scoped bookmarks for recent ROMs, picked directories; battery saves default to ` /Saves` and a picked BIOS

corazawafCLAUDE.md

coraza

corazawaf/coraza/CLAUDE.md

AGENTS.md](AGENTS.md). Read it before making changes; the testing, ADR, pull request and security sections are mandatory. @AGENTS.md

openrewriteCLAUDE.md

rewrite

openrewrite/rewrite/CLAUDE.md

local Maven repository ./gradlew publishToMavenLocal # Apply license headers to files ./gradlew licenseFormat # Run security vulnerability check ./gradlew dependencyCheck ``` ### Running Single Tests ```bash # Test specific module ./gradlew :rewrite-java:test # Test

bytebaseReads credentialsCLAUDE.md

dbhub

bytebase/dbhub/CLAUDE.md

connection pool + buffer cache metrics tool (Postgres/MySQL/MariaDB/SQL Server/Oracle) ├── utils/ # Shared utilities │ ├── dsn-obfuscator.ts# DSN security │ ├── response-formatter.ts # Output formatting │ ├── allowed-keywords.ts # Read-only SQL classification primitives │ └── sql-access-policy.ts # Statement class → verdict pipeline (single source

No other project uses it yet

HolmesGPTReads credentialsCLAUDE.md

holmesgpt

HolmesGPT/holmesgpt/CLAUDE.md

reverting only the file you noticed leaves the others still acting on the model. ## Security Notes - All tools have read-only access by design - Bash toolset validates commands for safety

sozu-proxyCLAUDE.md

sozu

sozu-proxy/sozu/CLAUDE.md

crate, moonpool-driven), and **regression guards** (`lib/tests/log_layout.rs`). E2E suites (non-exhaustive): `h2_tests.rs` + `h2_correctness_tests.rs` + `h2_security_{tests,parser,session,sni,header_injection}.rs` + `h2_priority_rearm_tests.rs` (~181 H2 tests); `mux_tests.rs` (H1 + proxy-protocol

No other project uses it yet

ExTVCLAUDE.md

Podroid

ExTV/Podroid/CLAUDE.md

averages about 3x, so the backing store stays well under RAM). `CONFIG_EXT4_FS_SECURITY=y` + `CONFIG_SQUASHFS_XATTR=y` keep `security.capability` xattrs across the overlay (rootless podman's `newuidmap

nextlevelbuilderReads credentialsCLAUDE.md

goclaw

nextlevelbuilder/goclaw/CLAUDE.md

JSON5 at `GOCLAW_CONFIG` env. Secrets in `.env.local` or env vars, never in config.json - **Security:** Rate limiting, input guard (detection-only), CORS, shell deny patterns, SSRF protection, path traversal prevention

No other project uses it yet

tnodirCLAUDE.md

fort

tnodir/fort/CLAUDE.md

real driver (test-mode VM) - The machine needs `bcdedit /set testsigning on` and Secure Boot off. A self-signed code-signing certificate is enough (`signtool sign /fd sha256 /f test.pfx

samberPipes a download into a shellCLAUDE.md

cc-skills-golang

samber/cc-skills-golang/CLAUDE.md

goreleaser:*)` | CI/CD or release skills | | `Bash(gh:*)` | Git or GitHub-related skills | | `Bash(govulncheck:*)` | Security or dependency management skills | | `Bash(curl:*)` | API testing or GraphQL skills | | `WebFetch` | Library-specific skills

No other project uses it yet

edtechreCLAUDE.md

pybroker

edtechre/pybroker/CLAUDE.md

checkout; `.github/scripts/asv_gate.py` makes the benchmark block/pass decision (see above). - **Workflow security is gated by two tools, not by a script.** The `workflow-audit` job in both `main.yml` and `schedule.yml` runs

pedramaminiReads credentialsCLAUDE.md

Maestro

pedramamini/Maestro/CLAUDE.md

# CLAUDE.md Essential guidance for working with this codebase. For detailed architecture, see [ARCHITECTURE.md](ARCHITECTURE.md

chrisvelReads credentialsCLAUDE.md

tududi

chrisvel/tududi/CLAUDE.md

HTTP transport modes - Claude Desktop, Cursor, VS Code configuration - API token authentication and security 24. **[PWA & Offline Support](docs/15-pwa.md)** - Installable as a Progressive Web App (home screen on mobile

QDataCLAUDE.md

TextAttack

QData/TextAttack/CLAUDE.md

/3.9 (pytest currently skipped in CI) - `publish-to-pypi.yml` - PyPI publishing - `make-docs.yml` - Documentation build - `codeql-analysis.yml` - Security analysis ### Test Structure Tests are in `tests/` organized by feature: - `test_command_line/` - CLI command integration

lmnr-aiReads credentialsCLAUDE.md

lmnr

lmnr-ai/lmnr/CLAUDE.md

Before working in one of these areas, read the matching file** — it documents invariants, security boundaries, and gotchas that are not inferable from the code: | File | Read when touching | |---|---| | `docs/internal/rust-best-practices.md

Intelligent-InternetCLAUDE.md

ii-agent

Intelligent-Internet/ii-agent/CLAUDE.md

everywhere** -- never use bare `= Depends(get_x)` in function signatures (exception: `credentials: HTTPAuthorizationCredentials = Depends(security)` in auth). 3. **Import Dep aliases** from other domains instead of importing their factory functions

kuafuaiReads credentialsCLAUDE.md

andee

kuafuai/andee/CLAUDE.md

audience.** `README.md` is the **English** front page (what it is, architecture, build, permissions, security). `README.zh-CN.md` is the **Chinese** guide and is the authoritative setup/permissions walkthrough — read it for first-time