CLAUDE.md examples from real projects

sveltiaCLAUDE.md

sveltia-cms

sveltia/sveltia-cms/CLAUDE.md

/code-review --fix` repeatedly until it reports no findings. - Also run `/security-review` to check for security issues if the change touches a backend, API client, integration, or any code that handles

No other project uses it yet

6Kmfi6HPCLAUDE.md

EDtunnel

6Kmfi6HP/EDtunnel/CLAUDE.md

query parameters can override: `proxyip`, `socks5` (UUID cannot be overridden for security). ## Key Implementation Details - Uses Cloudflare's `cloudflare:sockets` for TCP connections - VLESS protocol version 0 with WebSocket transport

visaReads credentialsCLAUDE.md

visa-vulnerability-agentic-harness

visa/visa-vulnerability-agentic-harness/CLAUDE.md

repo.** It is the operating manual for running vvaharness. vvaharness is a *released* CLI security-scanning product — operate it, don't develop or repair it. A hand-edited tool gives

allenpeng0705Reads credentialsCLAUDE.md

EnvoyMesh

allenpeng0705/EnvoyMesh/CLAUDE.md

without any central server or cloud dependency. Identity is cryptographic (Ed25519), messages are signed, security is policy-based, and everything is auditable. **Core principles:** - No central account server — identity

Shelf-nuReads credentialsCLAUDE.md

shelf.nu

Shelf-nu/shelf.nu/CLAUDE.md

warnings stay advisory). See [companion:doctor](#companion-app-mobile) for the React Native equivalent. ### Security Review Agent (pre-commit) A Claude-powered security reviewer runs automatically on `git commit` against

tobychuiCLAUDE.md

arozos

tobychui/arozos/CLAUDE.md

license of each new dependency before merging. ### 4. New endpoints get the right security control Register authenticated endpoints through the permission router, not raw `http.HandleFunc`, so they inherit login

minioReads credentialsCLAUDE.md

minio-go

minio/minio-go/CLAUDE.md

pkg/credentials/` package provides various credential providers: - Static credentials - Environment variables (AWS/MinIO) - IAM roles - STS (Security Token Service) variants - File-based credentials - Chain provider for fallback mechanisms 3. **Request Signing

marketcallsReads credentialsCLAUDE.md

openalgo

marketcalls/openalgo/CLAUDE.md

login (Indian brokers only), weekly upgrade, and the static IP limit for Live orders ## Security and Deployment Model - **Single user per deployment** — no multi-user, no privilege escalation. One user

ax-llmReads credentialsCLAUDE.md

ax

ax-llm/ax/docs/CLAUDE.md

website/` - Examples serve as living documentation - Include prompt signature examples in code comments ## Security & Best Practices - Never commit API keys - Use environment variables for configuration - Validate all inputs, especially

No other project uses it yet

CanineHQCLAUDE.md

canine

CanineHQ/canine/CLAUDE.md

spec/models/user_spec.rb:42 ``` ### Code Quality ```bash # Ruby linting bin/rubocop # Auto-fix linting issues bin/rubocop -a # Security scanning bin/brakeman ``` ### Database ```bash # Run migrations rails db:migrate # Reset test database rails db:test

DarkaOnLineCLAUDE.md

L5-Swagger

DarkaOnLine/L5-Swagger/CLAUDE.md

base path as a Server URL 5. `saveJson()` — writes JSON, then `SecurityDefinitions::generate()` injects security schemes 6. `makeYamlCopy()` — optional YAML conversion via `symfony/yaml` Custom processors can be positioned relative

No other project uses it yet

kaitrannttCLAUDE.md

ccs

kaitranntt/ccs/CLAUDE.md

stable source link is enough. Update the owning documentation when behavior, commands, setup, architecture, security posture, or maintainer workflow changes. Remove stale claims instead of preserving them as TODOs. ## User

No other project uses it yet

compozyCLAUDE.md

compozy / internal

compozy/compozy/internal/CLAUDE.md

changed invariant; keep status-plus-body assertions and the project coverage floor. ## Security - Raw claim tokens, MCP auth tokens, OAuth codes, PKCE verifiers, and bound secrets stay out of logs

No other project uses it yet

szTheoryCLAUDE.md

exifcleaner

szTheory/exifcleaner/CLAUDE.md

throw Error objects in main - **Platform code**: guard with `isMac()` / `isWindows()` / `isLinux()` from `common/platform.ts` - **Security**: always use `sanitize()` from `renderer/sanitize.ts` for exiftool output (XSS prevention) - **i18n**: add translations to `.resources/strings.json

jgravelleReads credentialsCLAUDE.md

jcodemunch-mcp

jgravelle/jcodemunch-mcp/CLAUDE.md

warning; a guard that just banned the call would be satisfied by deleting the security check. ⚠ **Installed-and-correctly-named is NOT sufficient**, so the fast path also proves

ComplianceAsCodeCLAUDE.md

content

ComplianceAsCode/content/.claude/CLAUDE.md

specific rules (fastest, for testing individual rules) ./build_product ocp4 --rule-id api_server_tls_security_profile ``` Build output goes to `build/`. The data stream file is at: `build/ssg- -ds.xml

zenhostaReads credentialsCLAUDE.md

9drive

zenhosta/9drive/CLAUDE.md

when working with code in this repository. @AGENTS.md `AGENTS.md` (imported above) holds the conventions, security rules, env vars, and API list. This file adds what it leaves out, and notes

useautumnCLAUDE.md

autumn

useautumn/autumn/.claude/CLAUDE.md

this. Use full words. Example: `cusProduct` -> `customerProduct`. Widely accepted conventions like `ctx` are acceptable. ### Security - Add `rel="noopener"` when using `target="_blank"` on links - Avoid `dangerouslySetInnerHTML` unless absolutely necessary

No other project uses it yet

overwirehqReads credentialsCLAUDE.md

claude-code-telegram

overwirehq/claude-code-telegram/CLAUDE.md

directory, persisted in SQLite. ### Request Flow **Agentic mode** (default, `AGENTIC_MODE=true`): ``` Telegram message -> Security middleware (group -3) -> Auth middleware (group -2) -> Rate limit (group -1) -> MessageOrchestrator.agentic_text() (group

cexllCLAUDE.md

myclaude / memorys

cexll/myclaude/memorys/CLAUDE.md

upfront plan. Construct a private rubric with at least five categories (maintainability, performance, security, style, documentation, backward compatibility). Evaluate the work before finalizing; revisit the implementation if any category misses