CLAUDE.md examples from real projects

ParabolIncReads credentialsCLAUDE.md

parabol

ParabolInc/parabol/.claude/CLAUDE.md

checks live in permissions.ts (graphql-shield), not inline in resolvers. Never trust client-supplied security facts (granted scopes, team ids) — derive them server-side. Every new GraphQL field needs explicit

No other project uses it yet

MicrosoftCLAUDE.md

PowerApps-Samples

microsoft/PowerApps-Samples/CLAUDE.md

ImageOperations**: Image column handling - **Schema**: Metadata operations, entity creation - **Search**: Dataverse search, elastic search - **Security**: Role management, sharing, field security - **ServiceClient**: Modern client usage patterns - **Solutions**: Solution management and deployment

LynpointCLAUDE.md

CyberVerse

Lynpoint/CyberVerse/claude.md

real root cause. - Reject fixes that only patch symptoms. - Reject changes that damage architecture, security, performance, maintainability, or type safety. - Prefer minimal correct fixes over large unnecessary rewrites. - Explain

beikeshopReads credentialsCLAUDE.md

beikeshop

beikeshop/beikeshop/CLAUDE.md

level `lang/` 4. **Cache**: Clear cache after config changes with `php artisan config:clear` ## Security - Never commit `.env` file - Change default admin password in production - Use HTTPS in production environment

WorldFlowAIReads credentialsCLAUDE.md

everything-claude-code / examples

WorldFlowAI/everything-claude-code/examples/CLAUDE.md

Unit tests for utilities - Integration tests for APIs - E2E tests for critical flows ### 4. Security - No hardcoded secrets - Environment variables for sensitive data - Validate all user inputs - Parameterized queries only

vstorm-coCLAUDE.md

full-stack-ai-agent-template

vstorm-co/full-stack-ai-agent-template/CLAUDE.md

backend/ │ ├── app/ │ │ ├── main.py # FastAPI app with lifespan │ │ ├── api/ # Routes, deps, exception handlers │ │ ├── core/ # Config, security, middleware │ │ ├── db/ # Models, session management │ │ ├── schemas/ # Pydantic request/response models │ │ ├── repositories/ # Data access layer │ │ ├── services/ # Business

bcgitCLAUDE.md

bc-csharp

bcgit/bc-csharp/CLAUDE.md

source tree; the FIPS distribution is separate. Root namespace: `Org.BouncyCastle`. NuGet package id: `BouncyCastle.Cryptography`. Security issues: see [SECURITY.md](SECURITY.md) — report privately to feedback-crypto@bouncycastle.org rather than filing a public issue. ## Solution

higgsfield-aiReads credentialsCLAUDE.md

skills

higgsfield-ai/skills/CLAUDE.md

marketplace-cards/ │ └── SKILL.md ├── higgsfield-websites/ │ ├── SKILL.md │ └── references/ # stack, wow-maker, auth, fnf-sdk, seo-*, security-* ├── higgsfield-faceless-video/ │ ├── SKILL.md │ ├── scripts/ │ └── references/ ├── higgsfield-video-explainer/ │ ├── SKILL.md │ └── SKILL.md ├── evals/ # dev-only test

No other project uses it yet

openagenCLAUDE.md

zeroclaw

openagen/zeroclaw/CLAUDE.md

Rust-first autonomous agent runtime optimized for performance, efficiency, stability, extensibility, sustainability, and security. Core architecture is trait-driven and modular. Extend by implementing traits and registering in factory modules

trailofbitsCLAUDE.md

publications

trailofbits/publications/CLAUDE.md

Papers 3. Guides and Handbooks 4. Conference Presentations 5. Podcasts 6. Public Comments 7. Security Reviews 8. Disclosures 9. Workshops 10. Datasets 11. Service Overviews - Within each section, entries should

Datus-aiCLAUDE.md

Datus-agent

Datus-ai/Datus-agent/CLAUDE.md

cases: deprecated public APIs/config fields (e.g. a removed YAML key must be silently ignored), security fixes (e.g. secrets must not appear in logs), and removed side effects with real regression

No other project uses it yet

DyneteqReads credentialsCLAUDE.md

reconya

Dyneteq/reconya/CLAUDE.md

every third-party lookup is an explicit opt-in flag **Target Users:** Network administrators, security professionals, home users monitoring their own LAN. --- ## Technology Stack **Backend:** - Go 1.25, `net/http` + `gorilla/mux` - SQLite

meganzCLAUDE.md

android / data

meganz/android/data/CLAUDE.md

Repository` implementations of `:domain` interfaces (also organized into feature subpackages: `chat/`, `account/`, `photos/`, `files/`, `security/`, etc.). - `gateway/` — interfaces abstracting SDK and platform access (e.g. `gateway/api/MegaApiGateway`, `MegaChatApiGateway`, `MegaApiFolderGateway`, `StreamingGateway`, plus `FileGateway

nilsteampassnetDeletes or force-pushesCLAUDE.md

TeamPass

nilsteampassnet/TeamPass/CLAUDE.md

Overview TeamPass is a collaborative on-premise password manager built in PHP. It emphasizes security through multi-layer encryption, comprehensive audit logging, and granular role-based access control. **Tech Stack

No other project uses it yet

zakirkunReads credentialsCLAUDE.md

guardian-cli

zakirkun/guardian-cli/CLAUDE.md

ReporterAgent) over a pluggable AI provider layer (OpenAI, Claude, Gemini, OpenRouter) and 19 external security tool wrappers, executed via YAML-defined workflows. Designed exclusively for authorized testing. ## Common Commands Windows

CactiCLAUDE.md

cacti

Cacti/cacti/CLAUDE.md

adds test organization, path-depth and dependency rules. Keep shared guidance free of private security-research notes. Use `mise` for the PHP/Node versions declared by Composer, `.nvmrc

mercurjsCLAUDE.md

mercur

mercurjs/mercur/CLAUDE.md

Medusa", load `.claude/skills/mercur-review/SKILL.md`. It runs independent reviewer agents (Medusa patterns, dashboard patterns, technical QA, security, taste) against `references/`, triages findings into actionable / nit / ambiguous, fixes the actionable ones, verifies them

AnthropicCLAUDE.md

claude-agent-sdk-typescript

anthropics/claude-agent-sdk-typescript/CLAUDE.md

CLAUDE.md Guidance for Claude Code and other coding agents working in this repository. ## Security hardening for GitHub Actions Workflow jobs in this repository that call Claude run with three protections

No other project uses it yet

OpenAdaptAICLAUDE.md

OpenAdapt

OpenAdaptAI/OpenAdapt/CLAUDE.md

monolith - `docs/`: noncanonical historical repository documentation; docs.openadapt.ai is maintained in `OpenAdaptAI/openadapt-ops` - `.github/`: CI, security, dependency, and release workflows ## Development and delivery ```bash python -m pip install -e '.[dev]' pytest ruff

No other project uses it yet

matsuzaka-yukiReads credentialsCLAUDE.md

Mizuki

matsuzaka-yuki/Mizuki/CLAUDE.md

plain language instead (e.g., "verify: running curl /api/users returns 200 with expected JSON"). ### 5. Security Baseline **Never commit keys or sensitive credentials to the repository.** - All API keys, tokens, passwords