CLAUDE.md examples from real projects

OpenBankProjectCLAUDE.md

OBP-API

OpenBankProject/OBP-API/CLAUDE.md

deliberately left alone pending a contract decision). Personal notes, working memos and security findings live in `_DO_NOT_COMMIT_/`, which is gitignored but still visible to you on disk — treat

dsd2077CLAUDE.md

CyberVerse

dsd2077/CyberVerse/claude.md

real root cause. - Reject fixes that only patch symptoms. - Reject changes that damage architecture, security, performance, maintainability, or type safety. - Prefer minimal correct fixes over large unnecessary rewrites. - Explain

fynnflueggeCLAUDE.md

agtx

fynnfluegge/agtx/CLAUDE.md

paths exactly (agtx seeds each worktree into `trustedWorkspaces` when the root is trusted). **`AgentDialog::security` splits the table** — trust/bypass prompts are the user's decision: with `auto_trust = false` (default

Caho1CLAUDE.md

open-claude-ui

Caho1/open-claude-ui/CLAUDE.md

guards (`!(isComposing || keyCode === 229)`) and 150ms scroll pinning cooldown latch against viewport hijacking. 5. **Security**: Keep iframe sandbox strictly isolated (no `allow-same-origin`) and gated with `navigator.userActivation

No other project uses it yet

sachaosCLAUDE.md

todoist

sachaos/todoist/CLAUDE.md

Directory compliant) - Contains API token, color preferences, date formats - Permissions enforced to 0600 for security - **Cache**: Stored in `$HOME/.cache/todoist/cache.json` - Full sync from Todoist API using sync token - Enables offline browsing

No other project uses it yet

trailofbitsCLAUDE.md

buttercup

trailofbits/buttercup/CLAUDE.md

scheduler --tail=-1 --prefix | grep "WAIT_PATCH_PASS -> SUBMIT_BUNDLE" ``` ## Security Considerations - All untrusted code execution happens in isolated Docker containers - DinD (Docker-in-Docker) provides additional isolation - Redis queues

easysoftCLAUDE.md

zentaopms

easysoft/zentaopms/CLAUDE.md

Uses strict types declaration in newer files - Extensive use of custom framework classes ### Security - Custom authentication and authorization system - Input filtering via `lib/filter/` - SQL injection protection through DAO layer ### Performance

userdocsCLAUDE.md

qbittorrent-nox-static

userdocs/qbittorrent-nox-static/CLAUDE.md

technical expert in Bash scripting. Follow the guidelines in CLAUDE.md exactly. Prioritize secure, robust, and efficient code using proper quoting, error handling, and the "do one thing well" philosophy. Never

rustfinityCLAUDE.md

rustfinity

rustfinity/rustfinity/CLAUDE.md

tool for downloading and submitting challenges locally - **crates/rustfinity-runner**: Test runner that executes code in secure Docker containers - **crates/syntest**: Syntax-based testing library using Rust AST analysis ## Build and Test Commands

naomiaroCLAUDE.md

waveform-playlist

naomiaro/waveform-playlist/CLAUDE.md

closure, check WHICH section a workspace ref lives in before suspecting a missed bump. **Security-key-only 2FA (since 2026-10-28): `changeset publish` cannot publish from this session

whitphxCLAUDE.md

stlite

whitphx/stlite/CLAUDE.md

latest CPython patch release of that minor to pick up security fixes. Renovate opens patch-only PRs for `.python-version`, and the `check-python-version` CI job (`.github/scripts/check-python-version.sh`) fails when

nohajcCLAUDE.md

anylinuxfs

nohajc/anylinuxfs/CLAUDE.md

builder/` — **Unmaintained.** Do not modify. ## Known Context See [GEMINI.md](GEMINI.md) for additional architectural context, security model, platform details, and workflow rules

lst97CLAUDE.md

claude-code-sub-agents

lst97/claude-code-sub-agents/CLAUDE.md

tests for new logic, both UI and API. **Before committing:** - Run formatter, linter, and security scans. - Ensure commit messages explain *why*, not just *what*. ### Error Handling - Fail fast with descriptive

soimyCLAUDE.md

clawdbot-channel-dingtalk

soimy/clawdbot-channel-dingtalk/CLAUDE.md

singleton. ### Core Module Responsibilities - **`src/channel.ts`** — Assembly layer only. Defines `dingtalkPlugin` (config, gateway, outbound, status, security, messaging, directory). Delegates all heavy logic to service modules. Keep this file thin. - **`src/gateway/inbound-handler.ts`** — Inbound

mediar-aiCLAUDE.md

terminator

mediar-ai/terminator/CLAUDE.md

integration - See `examples/simple_notepad_workflow/` for best practices - If CLI shows "(no parser)" → check `workflow_typescript.rs:379-398` **Security:** - ❌ **NEVER use `#id` selectors** (non-deterministic across machines) - ❌ Don't commit credentials - ✅ Use `role:Type

archestra-aiCLAUDE.md

OpenAPPA

archestra-ai/OpenAPPA/CLAUDE.md

operation), *turn*, *tool call*, *emission*, *actor/agent*, and *harness*. Use the classical IFC or security term when it adds precision or establishes lineage, and gloss it for public readers at first

No other project uses it yet

DockerCLAUDE.md

mcp-gateway

docker/mcp-gateway/CLAUDE.md

Overview This is the **Docker MCP Gateway** - a CLI plugin that enables easy and secure running of Model Context Protocol (MCP) servers through Docker containers. The plugin acts

No other project uses it yet

iotexprojectCLAUDE.md

iotex-core / consensus

iotexproject/iotex-core/consensus/CLAUDE.md

proposer/endorser-is-a-valid-delegate checks run before `ProduceReceiveBlockEvent` etc. are emitted (`rolldpos.go`). Reordering this is a security break. ### Do not retain endorsements past round start - `endorsementmanager.go` discards endorsements older than the current round

Flux159CLAUDE.md

mcp-server-kubernetes

Flux159/mcp-server-kubernetes/CLAUDE.md

that's needed — CD handles the version bump, publish, and asset uploads from there. ## Security Fixes and Coordinated Disclosure When a change fixes a security issue tracked by a GHSA

AltanSCLAUDE.md

collie

AltanS/collie/CLAUDE.md

keeps the daily cadence.** A patch the operator must take today, data loss, a security fix, a broken update path, may carry ONE line directly under the release heading

No other project uses it yet