CLAUDE.md examples from real projects

allenpeng0705Reads credentialsCLAUDE.md

EnvoyMesh

allenpeng0705/EnvoyMesh/CLAUDE.md

without any central server or cloud dependency. Identity is cryptographic (Ed25519), messages are signed, security is policy-based, and everything is auditable. **Core principles:** - No central account server — identity

Shelf-nuReads credentialsCLAUDE.md

shelf.nu

Shelf-nu/shelf.nu/CLAUDE.md

warnings stay advisory). See [companion:doctor](#companion-app-mobile) for the React Native equivalent. ### Security Review Agent (pre-commit) A Claude-powered security reviewer runs automatically on `git commit` against

tobychuiCLAUDE.md

arozos

tobychui/arozos/CLAUDE.md

license of each new dependency before merging. ### 4. New endpoints get the right security control Register authenticated endpoints through the permission router, not raw `http.HandleFunc`, so they inherit login

minioReads credentialsCLAUDE.md

minio-go

minio/minio-go/CLAUDE.md

pkg/credentials/` package provides various credential providers: - Static credentials - Environment variables (AWS/MinIO) - IAM roles - STS (Security Token Service) variants - File-based credentials - Chain provider for fallback mechanisms 3. **Request Signing

ax-llmReads credentialsCLAUDE.md

ax

ax-llm/ax/docs/CLAUDE.md

website/` - Examples serve as living documentation - Include prompt signature examples in code comments ## Security & Best Practices - Never commit API keys - Use environment variables for configuration - Validate all inputs, especially

No other project uses it yet

marketcallsReads credentialsCLAUDE.md

openalgo

marketcalls/openalgo/CLAUDE.md

login (Indian brokers only), weekly upgrade, and the static IP limit for Live orders ## Security and Deployment Model - **Single user per deployment** — no multi-user, no privilege escalation. One user

CanineHQCLAUDE.md

canine

CanineHQ/canine/CLAUDE.md

spec/models/user_spec.rb:42 ``` ### Code Quality ```bash # Ruby linting bin/rubocop # Auto-fix linting issues bin/rubocop -a # Security scanning bin/brakeman ``` ### Database ```bash # Run migrations rails db:migrate # Reset test database rails db:test

DarkaOnLineCLAUDE.md

L5-Swagger

DarkaOnLine/L5-Swagger/CLAUDE.md

base path as a Server URL 5. `saveJson()` — writes JSON, then `SecurityDefinitions::generate()` injects security schemes 6. `makeYamlCopy()` — optional YAML conversion via `symfony/yaml` Custom processors can be positioned relative

No other project uses it yet

kaitrannttCLAUDE.md

ccs

kaitranntt/ccs/CLAUDE.md

stable source link is enough. Update the owning documentation when behavior, commands, setup, architecture, security posture, or maintainer workflow changes. Remove stale claims instead of preserving them as TODOs. ## User

compozyCLAUDE.md

compozy / internal

compozy/compozy/internal/CLAUDE.md

changed invariant; keep status-plus-body assertions and the project coverage floor. ## Security - Raw claim tokens, MCP auth tokens, OAuth codes, PKCE verifiers, and bound secrets stay out of logs

No other project uses it yet

szTheoryCLAUDE.md

exifcleaner

szTheory/exifcleaner/CLAUDE.md

throw Error objects in main - **Platform code**: guard with `isMac()` / `isWindows()` / `isLinux()` from `common/platform.ts` - **Security**: always use `sanitize()` from `renderer/sanitize.ts` for exiftool output (XSS prevention) - **i18n**: add translations to `.resources/strings.json

jgravelleReads credentialsCLAUDE.md

jcodemunch-mcp

jgravelle/jcodemunch-mcp/CLAUDE.md

warning; a guard that just banned the call would be satisfied by deleting the security check. ⚠ **Installed-and-correctly-named is NOT sufficient**, so the fast path also proves

No other project uses it yet

ComplianceAsCodeCLAUDE.md

content

ComplianceAsCode/content/.claude/CLAUDE.md

specific rules (fastest, for testing individual rules) ./build_product ocp4 --rule-id api_server_tls_security_profile ``` Build output goes to `build/`. The data stream file is at: `build/ssg- -ds.xml

zenhostaReads credentialsCLAUDE.md

9drive

zenhosta/9drive/CLAUDE.md

when working with code in this repository. @AGENTS.md `AGENTS.md` (imported above) holds the conventions, security rules, env vars, and API list. This file adds what it leaves out, and notes

useautumnCLAUDE.md

autumn

useautumn/autumn/.claude/CLAUDE.md

this. Use full words. Example: `cusProduct` -> `customerProduct`. Widely accepted conventions like `ctx` are acceptable. ### Security - Add `rel="noopener"` when using `target="_blank"` on links - Avoid `dangerouslySetInnerHTML` unless absolutely necessary

No other project uses it yet

overwirehqReads credentialsCLAUDE.md

claude-code-telegram

overwirehq/claude-code-telegram/CLAUDE.md

directory, persisted in SQLite. ### Request Flow **Agentic mode** (default, `AGENTIC_MODE=true`): ``` Telegram message -> Security middleware (group -3) -> Auth middleware (group -2) -> Rate limit (group -1) -> MessageOrchestrator.agentic_text() (group

cexllCLAUDE.md

myclaude / memorys

cexll/myclaude/memorys/CLAUDE.md

upfront plan. Construct a private rubric with at least five categories (maintainability, performance, security, style, documentation, backward compatibility). Evaluate the work before finalizing; revisit the implementation if any category misses

mas-bandwidthCLAUDE.md

yojimbo

mas-bandwidth/yojimbo/CLAUDE.md

failure is handled on essentially every path** deliberately, because this is a game server. SECURITY: yojimbo 1.6.3 and earlier vendor a netcode missing the AEAD nonce-reuse fix (netcode

mattermostReads credentialsCLAUDE.md

mattermost-mobile

mattermost/mattermost-mobile/CLAUDE.md

mattermost/rnutils` - Native utilities (orientation, notifications) - `@mattermost/rnshare` - Share extension integration - `@mattermost/hardware-keyboard` - External keyboard detection - `@mattermost/secure-pdf-viewer` - Secure PDF viewing **Native Bridge patterns** (when modifying native modules): - iOS: `RCT_EXPORT_MODULE()`, `RCT_EXPORT

addyosmaniCLAUDE.md

web-quality-skills

addyosmani/web-quality-skills/CLAUDE.md

accessibility | `skills/accessibility/` | "a11y", "WCAG", "accessible" | | seo | `skills/seo/` | "SEO", "meta tags", "search" | | best-practices | `skills/best-practices/` | "security", "best practices", "modern" | ### Key thresholds **Core Web Vitals (Good):** - LCP ≤ 2.5s - INP ≤ 200ms

No other project uses it yet