CLAUDE.md examples from real projects

jhd3197Reads credentialsCLAUDE.md

ServerKit

jhd3197/ServerKit/CLAUDE.md

ServerKit is a server control panel for managing web applications, databases, Docker containers, and security on VPS/dedicated servers. Flask backend (Python 3.11+), React frontend (Vite + SCSS), SQLite/PostgreSQL database, real-time

kenn-ioCLAUDE.md

roborev

kenn-io/roborev/CLAUDE.md

prompt), `compact` (consolidated multi-agent), `fix` (background worktree fix) ### Review types Empty/`"review"` (standard), `"security"`, `"design"` — changes the system prompt. `"exhaustive"` keeps the standard prompt and appends an instruction

Jedward23Deletes or force-pushesCLAUDE.md

Tmux-Orchestrator

Jedward23/Tmux-Orchestrator/CLAUDE.md

Engineer**: Testing and verification 4. **DevOps**: Infrastructure and deployment 5. **Code Reviewer**: Security and best practices 6. **Researcher**: Technology evaluation 7. **Documentation Writer**: Technical documentation ## 🔐 Git Discipline - MANDATORY

DialmasterOrgCLAUDE.md

Youtarr

DialmasterOrg/Youtarr/CLAUDE.md

docstrings, type comments or explanatory prose to code you did not change. ## Security Youtarr shells out to `yt-dlp` and writes files using user-influenced paths, so this section

SupabaseCLAUDE.md

postgres

supabase/postgres/CLAUDE.md

style compliance specs run against built images | | `.claude/skills/pg-security-release-analysis/` | Skill for triaging upstream PG quarterly security releases into a CVE/impact catalog — see below | ## Building and testing Exact commands verified against `nix/docs/build-postgres.md

security-unionCLAUDE.md

videocall-rs

security-union/videocall-rs/CLAUDE.md

Before making any recommendation or assessment about transport protocols (WebTransport, WebSocket, QUIC, datagrams, reliability), security design, or performance trade-offs, delegate to the relevant specialist agent first. Do not reason

lane711Deletes or force-pushesCLAUDE.md

sonicjs

lane711/sonicjs/CLAUDE.md

Routes: `packages/core/src/routes/admin.ts`, `admin-content.ts` Use `codegraph_explore` to inspect current patterns before building new pages. ## Security - Never expose secrets in code or tests. - Validate all user input at the boundary

RackulaLivesCLAUDE.md

Rackula

RackulaLives/Rackula/CLAUDE.md

release approval gate; it runs `versions deploy` only, so it never touches routes. Security headers come from `scripts/gen-headers.mjs`, which transcribes `deploy/security-headers.conf` by value and is parity-checked in CI. They

relaticleReads credentialsCLAUDE.md

relaticle

relaticle/relaticle/CLAUDE.md

=== .ai/relaticle/architecture rules === # Architecture Relaticle is a modular monolith: the CRM core lives in `app

No other project uses it yet

leonvanzylReads credentialsCLAUDE.md

autocoder

leonvanzyl/autocoder/CLAUDE.md

directory. ## Testing ### Python ```bash ruff check . # Lint mypy . # Type check python test_security.py # Security unit tests (12 tests) python test_security_integration.py # Integration tests (9 tests) python -m pytest test_client.py # Client tests

bohanwoodCLAUDE.md

debi

bohanwood/debi/CLAUDE.md

remote monitoring - `in_target()`: Executes commands within the target installation environment - `prompt_password()`: Securely handles password input with validation ## Important Configuration Variables The script uses 80+ configuration options. Key ones

Macro-Deck-AppCLAUDE.md

Macro-Deck

Macro-Deck-App/Macro-Deck/CLAUDE.md

documentation. Comment only for a reason the code cannot express: a security or trust assumption, a compatibility or protocol constraint, a platform workaround, an ordering or race requirement, deliberately surprising

OpenBankProjectCLAUDE.md

OBP-API

OpenBankProject/OBP-API/CLAUDE.md

deliberately left alone pending a contract decision). Personal notes, working memos and security findings live in `_DO_NOT_COMMIT_/`, which is gitignored but still visible to you on disk — treat

dsd2077CLAUDE.md

CyberVerse

dsd2077/CyberVerse/claude.md

real root cause. - Reject fixes that only patch symptoms. - Reject changes that damage architecture, security, performance, maintainability, or type safety. - Prefer minimal correct fixes over large unnecessary rewrites. - Explain

fynnflueggeCLAUDE.md

agtx

fynnfluegge/agtx/CLAUDE.md

paths exactly (agtx seeds each worktree into `trustedWorkspaces` when the root is trusted). **`AgentDialog::security` splits the table** — trust/bypass prompts are the user's decision: with `auto_trust = false` (default

Caho1CLAUDE.md

open-claude-ui

Caho1/open-claude-ui/CLAUDE.md

guards (`!(isComposing || keyCode === 229)`) and 150ms scroll pinning cooldown latch against viewport hijacking. 5. **Security**: Keep iframe sandbox strictly isolated (no `allow-same-origin`) and gated with `navigator.userActivation

No other project uses it yet

sachaosCLAUDE.md

todoist

sachaos/todoist/CLAUDE.md

Directory compliant) - Contains API token, color preferences, date formats - Permissions enforced to 0600 for security - **Cache**: Stored in `$HOME/.cache/todoist/cache.json` - Full sync from Todoist API using sync token - Enables offline browsing

No other project uses it yet

trailofbitsCLAUDE.md

buttercup

trailofbits/buttercup/CLAUDE.md

scheduler --tail=-1 --prefix | grep "WAIT_PATCH_PASS -> SUBMIT_BUNDLE" ``` ## Security Considerations - All untrusted code execution happens in isolated Docker containers - DinD (Docker-in-Docker) provides additional isolation - Redis queues

easysoftCLAUDE.md

zentaopms

easysoft/zentaopms/CLAUDE.md

Uses strict types declaration in newer files - Extensive use of custom framework classes ### Security - Custom authentication and authorization system - Input filtering via `lib/filter/` - SQL injection protection through DAO layer ### Performance

tinyfish-ioReads credentialsCLAUDE.md

bigset / backend

tinyfish-io/bigset/backend/CLAUDE.md

other datasets; `authContext` (Clerk userId + workflow run id) is captured for caller-attribution in security logs and the `CAPABILITY_VIOLATION` PostHog event. See the security note