CLAUDE.md examples from real projects

NikolaySCLAUDE.md

pgque

NikolayS/pgque/CLAUDE.md

Architecture Two-layer design: - **pgque-core:** Productization of PgQ (rename, PG14+ modernization, pg_cron, security hardening, single-file install). Mechanical transformation of ~4,028 lines of proven PL/pgSQL. - **pgque

stephengpopeReads credentialsCLAUDE.md

thepopebot

stephengpope/thepopebot/CLAUDE.md

changes - **ALWAYS** make schema changes by editing `lib/db/schema.js` then running `npm run db:generate` ## Security: Route Architecture **`/api` routes are for external callers only.** They authenticate

j3ssieReads credentialsCLAUDE.md

metabigor

j3ssie/metabigor/CLAUDE.md

using local DB - **Don't ignore cleanup**: Close HTTP clients, Chrome instances, file handles ### Security Considerations - **No credentials in code**: This tool specifically avoids API keys - **Input validation**: Sanitize user

relaticleReads credentialsCLAUDE.md

relaticle

relaticle/relaticle/CLAUDE.md

=== .ai/relaticle/architecture rules === # Architecture Relaticle is a modular monolith: the CRM core lives in `app

mozilla-servicesReads credentialsCLAUDE.md

syncstorage-rs

mozilla-services/syncstorage-rs/CLAUDE.md

contains a Rust multi-crate server plus Python utilities and integration/end-to-end tests. ## Agent rules Security takes absolute precedence. This repository handles synchronization of user data and token management to access

No other project uses it yet

RelaticleReads credentialsCLAUDE.md

relaticle

Relaticle/relaticle/CLAUDE.md

=== .ai/relaticle/architecture rules === # Architecture Relaticle is a modular monolith: the CRM core lives in `app

No other project uses it yet

jhd3197Reads credentialsCLAUDE.md

ServerKit

jhd3197/ServerKit/CLAUDE.md

ServerKit is a server control panel for managing web applications, databases, Docker containers, and security on VPS/dedicated servers. Flask backend (Python 3.11+), React frontend (Vite + SCSS), SQLite/PostgreSQL database, real-time

kenn-ioCLAUDE.md

roborev

kenn-io/roborev/CLAUDE.md

prompt), `compact` (consolidated multi-agent), `fix` (background worktree fix) ### Review types Empty/`"review"` (standard), `"security"`, `"design"` — changes the system prompt. `"exhaustive"` keeps the standard prompt and appends an instruction

Jedward23Deletes or force-pushesCLAUDE.md

Tmux-Orchestrator

Jedward23/Tmux-Orchestrator/CLAUDE.md

Engineer**: Testing and verification 4. **DevOps**: Infrastructure and deployment 5. **Code Reviewer**: Security and best practices 6. **Researcher**: Technology evaluation 7. **Documentation Writer**: Technical documentation ## 🔐 Git Discipline - MANDATORY

SupabaseCLAUDE.md

postgres

supabase/postgres/CLAUDE.md

style compliance specs run against built images | | `.claude/skills/pg-security-release-analysis/` | Skill for triaging upstream PG quarterly security releases into a CVE/impact catalog — see below | ## Building and testing Exact commands verified against `nix/docs/build-postgres.md

DialmasterOrgCLAUDE.md

Youtarr

DialmasterOrg/Youtarr/CLAUDE.md

docstrings, type comments or explanatory prose to code you did not change. ## Security Youtarr shells out to `yt-dlp` and writes files using user-influenced paths, so this section

security-unionCLAUDE.md

videocall-rs

security-union/videocall-rs/CLAUDE.md

Before making any recommendation or assessment about transport protocols (WebTransport, WebSocket, QUIC, datagrams, reliability), security design, or performance trade-offs, delegate to the relevant specialist agent first. Do not reason

lane711Deletes or force-pushesCLAUDE.md

sonicjs

lane711/sonicjs/CLAUDE.md

Routes: `packages/core/src/routes/admin.ts`, `admin-content.ts` Use `codegraph_explore` to inspect current patterns before building new pages. ## Security - Never expose secrets in code or tests. - Validate all user input at the boundary

RackulaLivesCLAUDE.md

Rackula

RackulaLives/Rackula/CLAUDE.md

release approval gate; it runs `versions deploy` only, so it never touches routes. Security headers come from `scripts/gen-headers.mjs`, which transcribes `deploy/security-headers.conf` by value and is parity-checked in CI. They

leonvanzylReads credentialsCLAUDE.md

autocoder

leonvanzyl/autocoder/CLAUDE.md

directory. ## Testing ### Python ```bash ruff check . # Lint mypy . # Type check python test_security.py # Security unit tests (12 tests) python test_security_integration.py # Integration tests (9 tests) python -m pytest test_client.py # Client tests

bohanwoodCLAUDE.md

debi

bohanwood/debi/CLAUDE.md

remote monitoring - `in_target()`: Executes commands within the target installation environment - `prompt_password()`: Securely handles password input with validation ## Important Configuration Variables The script uses 80+ configuration options. Key ones

Macro-Deck-AppCLAUDE.md

Macro-Deck

Macro-Deck-App/Macro-Deck/CLAUDE.md

documentation. Comment only for a reason the code cannot express: a security or trust assumption, a compatibility or protocol constraint, a platform workaround, an ordering or race requirement, deliberately surprising

OpenBankProjectCLAUDE.md

OBP-API

OpenBankProject/OBP-API/CLAUDE.md

deliberately left alone pending a contract decision). Personal notes, working memos and security findings live in `_DO_NOT_COMMIT_/`, which is gitignored but still visible to you on disk — treat

fynnflueggeCLAUDE.md

agtx

fynnfluegge/agtx/CLAUDE.md

paths exactly (agtx seeds each worktree into `trustedWorkspaces` when the root is trusted). **`AgentDialog::security` splits the table** — trust/bypass prompts are the user's decision: with `auto_trust = false` (default

Caho1CLAUDE.md

open-claude-ui

Caho1/open-claude-ui/CLAUDE.md

guards (`!(isComposing || keyCode === 229)`) and 150ms scroll pinning cooldown latch against viewport hijacking. 5. **Security**: Keep iframe sandbox strictly isolated (no `allow-same-origin`) and gated with `navigator.userActivation

No other project uses it yet