CLAUDE.md examples from real projects

CherryHQCLAUDE.md

cherry-studio

CherryHQ/cherry-studio/CLAUDE.md

MUST READ**: [docs/references/ipc/README.md](docs/references/ipc/README.md) — paradigm boundary (RPC vs REST), schema/router/preload/facade layering, `IpcContext`, error model, security. Non-data command IPC (window/system/shell/notification/external/file) goes through **IpcApi** — the fifth subsystem alongside BootConfig/Cache/Preference/DataApi, RPC-over

No other project uses it yet

KeygraphHQReads credentialsCLAUDE.md

shannon

KeygraphHQ/shannon/CLAUDE.md

CLAUDE.md AI-powered penetration testing agent for defensive security analysis. Automates vulnerability assessment by combining reconnaissance tools with AI-powered code analysis. ## Commands **Prerequisites:** Docker, AI provider credentials

No other project uses it yet

abhigyanpatwariCLAUDE.md

GitNexus

abhigyanpatwari/GitNexus/CLAUDE.md

imports, or execution flow.** Graph first; text search only for empty/`UNKNOWN`/literals. - For security review, `explain({target: "fileOrSymbol"})` lists taint findings (source→sink flows; needs `analyze --pdg`). - For control/data

No other project uses it yet

luongnv89CLAUDE.md

claude-howto / uk

luongnv89/claude-howto/uk/CLAUDE.md

Якість коду ```bash # Lint and format Python code ruff check scripts/ ruff format scripts/ # Security scan bandit -c scripts/pyproject.toml -r scripts/ --exclude scripts/tests/ # Type checking mypy scripts/ --ignore-missing-imports

No other project uses it yet

luongnv89CLAUDE.md

claude-howto / vi

luongnv89/claude-howto/vi/CLAUDE.md

Lượng Code ```bash # Lint và format Python code ruff check scripts/ ruff format scripts/ # Security scan bandit -c scripts/pyproject.toml -r scripts/ --exclude scripts/tests/ # Type checking mypy scripts/ --ignore-missing-imports

No other project uses it yet

ccxtCLAUDE.md

ccxt

ccxt/ccxt/CLAUDE.md

# CCXT — Repository Guide for Contributors and AI Agents CCXT is a unified cryptocurrency trading

No other project uses it yet

AnthropicCLAUDE.md

financial-services

anthropics/financial-services/CLAUDE.md

named agent) │ └── / │ ├── agent.yaml # system + skills → ../../plugins/agent-plugins/ /... │ ├── subagents/*.yaml # depth-1 leaf workers │ ├── steering-examples.json │ └── README.md # security tier + handoff notes ├── claude-for-msft-365-install/ # admin tooling for the Microsoft

remoteintechCLAUDE.md

remote-jobs

remoteintech/remote-jobs/CLAUDE.md

sections. Posts a PR comment with results and blocks merge on errors. - **CodeQL** (`.github/workflows/codeql-analysis.yml`): Security scanning on push/PR and weekly schedule. ## Branch Protection The `main` branch has protection rules: - Requires

No other project uses it yet

TriliumNextReads credentialsCLAUDE.md

Trilium

TriliumNext/Trilium/CLAUDE.md

owning service + a spec. Load the **`developing-electron-desktop` skill** for the recipe, the security model, running/launch errors and testing. ### Flathub packaging `apps/desktop/flatpak/` holds the whole recipe — manifest, `trilium.sh`, `flathub.json

No other project uses it yet

filebrowserCLAUDE.md

filebrowser

filebrowser/filebrowser/.claude/CLAUDE.md

test ./...`. Reuse existing test harnesses (e.g. `signToken`, `scopedUserStorage`, `handle`, `customFSUser`, `mockUserStore`). --- # Handling security advisories Use this playbook when asked to triage, verify, fix, or manage GitHub security advisories. All advisory

nicolargoCLAUDE.md

glances

nicolargo/glances/CLAUDE.md

strict confinement blocks host file access at the open stage, not the read stage. ### Security Glances runs unauthenticated by default — this is intentional and documented. Most users deploy on private

No other project uses it yet

surrealdbCLAUDE.md

surrealdb

surrealdb/surrealdb/CLAUDE.md

execution, storage keys, or import/export, consult `SECURITY_GUIDE.md` and confirm the relevant invariants still hold. - Security model and review invariants: `SECURITY_GUIDE.md` - General code review checklist: `REVIEW.md` - SurrealQL docs: https://surrealdb.com/docs

No other project uses it yet

surrealdbCLAUDE.md

surrealdb / surrealism

surrealdb/surrealdb/surrealism/CLAUDE.md

exports without executing. Archives are self-contained; load them via `SurrealismPackage::from_file(path)`. ## Security Model - **Capabilities-based:** Modules declare needs in `surrealism.toml` (`[capabilities]`). Server validates at load time

No other project uses it yet

davila7Reads credentialsCLAUDE.md

claude-code-templates

davila7/claude-code-templates/CLAUDE.md

dashboard` still call `scripts/deploy.sh`, which is a stale **Vercel** deploy: do not use them. ## Security Guidelines ### ⛔ CRITICAL: NEVER Hardcode Secrets or IDs **NEVER write API keys, tokens, passwords, project

davila7CLAUDE.md

claude-code-templates

davila7/claude-code-templates/docs/CLAUDE.md

type has specific structure: **Agents** (162 total) - AI specialists organized by category (Development, Data/AI, Security, Business, etc.) - Stored in `cli-tool/components/agents/{category}/{name}.md` - Installation: `--agent ` **Commands** (210 total

topoteretesReads credentialsCLAUDE.md

cognee

topoteretes/cognee/CLAUDE.md

# CLAUDE.md This file provides guidance to Claude Code (claude.ai/code) when working with code

k1tbyteCLAUDE.md

Wand-Enhancer / web-panel

k1tbyte/Wand-Enhancer/web-panel/CLAUDE.md

public APIs should reveal what the product does. Prefer: ```text features/ checkout/ search/ account-security/ ``` Avoid making the application read primarily as: ```text components/ hooks/ services/ stores/ utils/ ``` Technical folders

projectdiscoveryCLAUDE.md

nuclei

projectdiscovery/nuclei/CLAUDE.md

repo's known vulnerabilities and recurring weak spots. Check it before writing or reviewing security-sensitive code

No other project uses it yet

tirth8205CLAUDE.md

code-review-graph

tirth8205/code-review-graph/CLAUDE.md

clients. - File reads: read the bytes once, hash them, then parse the same bytes. ## Security Invariants - No `eval()`, `exec()`, `pickle` or `yaml.unsafe_load()`. - No `shell=True` in subprocess calls. - `_validate

No other project uses it yet

vxcontrolReads credentialsCLAUDE.md

pentagi

vxcontrol/pentagi/CLAUDE.md

code token and needs its own deliberate edit. ## Project Overview **PentAGI** is an automated security testing platform powered by AI agents. A `primary_agent` drives a flow, a `generator`/`refiner

No other project uses it yet