CLAUDE.md examples from real projects

eneskircaReads credentialsCLAUDE.md

nodeterm

eneskirca/nodeterm/CLAUDE.md

main, so its `[webgl]` lines stay in the browser console. ### Server Edition sign-in (security audit 2026-10) The browser edition is reachable by anyone who can reach its login

ONLYOFFICECLAUDE.md

Docker-DocumentServer

ONLYOFFICE/Docker-DocumentServer/CLAUDE.md

variable - SSL/TLS with Let's Encrypt integration (Certbot) - Non-root execution possible ## Review Focus **Security**: JWT validation, SSL/TLS config, credential handling in entrypoint **Shell**: `run-document-server.sh` is critical — quoting, error handling

VercelCLAUDE.md

ai-elements

vercel/ai-elements/.claude/CLAUDE.md

Prefer simple conditionals over nested ternary operators - Group related code together and separate concerns ### Security - Add `rel="noopener"` when using `target="_blank"` on links - Avoid `dangerouslySetInnerHTML` unless absolutely necessary

InfisicalReads credentialsCLAUDE.md

agent-vault

Infisical/agent-vault/CLAUDE.md

passwordless mode), the DEK is stored in plaintext — suitable for PaaS deploys where volume security is the trust boundary. Login uses email+password. The first user to register becomes

OneKeyHQCLAUDE.md

app-monorepo

OneKeyHQ/app-monorepo/CLAUDE.md

components` or `kit`. - `@onekeyhq/kit`: `shared`, `components`, and `kit-bg`. - Apps may import all packages. ## Security - Never commit or log secrets, keys, seeds, mnemonics, or sensitive user data. - Do not bypass

No other project uses it yet

ArgeliusLabsCLAUDE.md

Chasing-Your-Tail-NG

ArgeliusLabs/Chasing-Your-Tail-NG/CLAUDE.md

WiGLE integration - **start_kismet_clean.sh**: ONLY working Kismet startup script (all others moved to old_scripts/) - **Security modules**: `secure_*.py` files providing SQL injection prevention and encrypted credentials ### Data Flow 1. Kismet

ddalcuReads credentialsCLAUDE.md

mlx-serve / app

ddalcu/mlx-serve/app/CLAUDE.md

# Swift macOS app (MLX Core) — AI context Compressed rules. Full war stories: `../docs/gotchas/app.md`. Full

MicroPyramidCLAUDE.md

Django-CRM

MicroPyramid/Django-CRM/CLAUDE.md

mobile/CLAUDE.md`. Both clients use the same API. Tenants are isolated by PostgreSQL row-level security underneath explicit ORM filters. ## Security first This is a production multi-tenant app under active

MicroPyramidCLAUDE.md

Django-CRM / mobile

MicroPyramid/Django-CRM/mobile/CLAUDE.md

codegen), go_router, Material 3 and Lucide icons. `../CLAUDE.md` applies here as well (security, web and mobile parity, comments, em dashes); this file covers only what is specific

hapifhirCLAUDE.md

hapi-fhir

hapifhir/hapi-fhir/CLAUDE.md

permitted to change any code under src/main folders pertaining to the security of the application. This includes any class that contains the word Security, Permission, Oidc, Authorization, Authority, Authentication, KeyStore

langhuihuiCLAUDE.md

monibuca

langhuihui/monibuca/CLAUDE.md

standard - **FLV:** Flash video format - **MP4:** MPEG-4 format with post-processing capabilities - **SRT:** Secure reliable transport - **S3:** File upload integration with AWS S3/MinIO compatibility ## Authentication & Security - JWT-based authentication

hzqstCLAUDE.md

VmwareHardenedLoader

hzqst/VmwareHardenedLoader/.claude/CLAUDE.md

navigation points needed for discovery: - Project purpose, source map, driver lifecycle, and dynamic-data security model: `core`. - Toolchain, System Informer dependency, and generated outputs: `tech_stack`. - Build and runtime commands

FasterXMLCLAUDE.md

jackson-core

FasterXML/jackson-core/CLAUDE.md

configuration flows through `TSFBuilder` / `JsonFactoryBuilder`. There is no mutable-setter fallback. ### Processing limits (security-relevant) Three per-factory config objects, with quite different scopes — don't conflate them: - **`StreamReadConstraints`** does

No other project uses it yet

levy-streetCLAUDE.md

world-of-claudecraft

levy-street/world-of-claudecraft/docs/CLAUDE.md

iOS/Android). Living. | | `sfx-studio-tutorial.md`, `codex.md` | Operator guides: the SFX Studio; the Codex support layer. Living. | | `security/` | `malware-scan-catalog.md`: the path-aware triage priors behind `scripts/malware_scan.mjs --gate`. `dependency-audit-catalog.md`: the `pnpm audit` gate model

levy-streetReads credentialsCLAUDE.md

world-of-claudecraft / scripts

levy-street/world-of-claudecraft/scripts/CLAUDE.md

browser resolver for the asset pipeline) | server + economy service (+ dev for visual) / none (thumbs) | | Security | `ws_security_e2e.mjs` (server), `malware_scan.mjs` (release-gate malicious-code flagger over the whole tree): `security:scan` exits

levy-streetCLAUDE.md

world-of-claudecraft / tests

levy-street/world-of-claudecraft/tests/CLAUDE.md

means touching this file. - SFX gates: the `sfx_*` suites (`sfx_conform`, `sfx_studio_server_security`, `tests/server/static_sfx_serving`, ...) mirror `npm run sfx:check`. - `malware_scan.test.ts` is the release-gate backstop (signatures from `scripts/malware_scan.mjs

zakirkunCLAUDE.md

deep-eye

zakirkun/deep-eye/CLAUDE.md

builders | | `.agents/skills/` | Agent skills: pentest, bug-bounty, red-team, blue-team, ctf, security-ops | ### Agent skills When the user asks for pentest / bug bounty / red team / blue team / CTF work

stacklokCLAUDE.md

toolhive

stacklok/toolhive/CLAUDE.md

Claude Code when working with this repository. ## Project Overview ToolHive is a lightweight, secure manager for MCP (Model Context Protocol: https://modelcontextprotocol.io) servers written in Go. It provides

No other project uses it yet

josephburnettCLAUDE.md

jd

josephburnett/jd/CLAUDE.md

/lib` - Deprecated v1 library (read-only) - `main.go` - Deprecated v1 commandline (read-only) ## Supply Chain Security - Dependencies MUST be minimal. Do not add new dependencies without justification. - GitHub Actions MUST

mampfesCLAUDE.md

hacs_waste_collection_schedule

mampfes/hacs_waste_collection_schedule/CLAUDE.md

contributor's branch and approve. Hardcoded data, missing API integration, security issues → request changes. - **Never commit directly to `master`** — local, origin, or upstream. Every change goes through a feature branch

No other project uses it yet