How real projects brief Claude Code: the commands, conventions and warnings they put in CLAUDE.md.
mpociotCLAUDE.mdmpociot/claude-code-slack-bot/CLAUDE.md
analyze using the Read tool - **Size Limits**: 50MB file size limit with automatic cleanup - **Security**: Secure download using Slack bot token authentication #### 4. Advanced Message Handling - **Streaming Responses**: Real-time
yologdevCLAUDE.mdyologdev/yoagent/CLAUDE.md
denies on NaN/missing; threshold setters and check-id collisions panic; **fails closed**. Not a security boundary. Spend: every `evaluate_request` inside a loop records into the `tokio::task_local!` `LoopScope
JoelLewisCLAUDE.mdJoelLewis/finance_skills/CLAUDE.md
skills) — investment knowledge, asset classes, portfolio construction, personal finance - **compliance** (17 skills) — US securities regulatory guidance (FINRA, SEC, ERISA, FinCEN, CFA Institute GIPS) - **advisory-practice** (12 skills) — advisor-facing systems
NVIDIACLAUDE.mdNVIDIA/topograph/.claude/CLAUDE.md
Verified** badge once the public key is uploaded to your GitHub account. ### Potential security issues If you discover what appears to be a security vulnerability while working in this codebase
QuentinCodyCLAUDE.mdQuentinCody/interlinked-cli/CLAUDE.md
check, gate, or threshold) **Interlinked is a portable, per-tool-call quality and security standard for agent-written code.** A local daemon sits in front of an agent's tool
softsparkCLAUDE.mdsoftspark/ai-toolkit/CLAUDE.md
parallel, see check_deps.py) # Validate: python3 scripts/validate.py # Evaluate: python3 scripts/evaluate_skills.py # Audit: python3 scripts/audit_skills.py --ci (security scan, exit 1 on HIGH) # Split gate: python3 scripts/check_split.py --before (run after every body -> reference/ split
joseairosaCLAUDE.mdjoseairosa/recall/CLAUDE.md
Decisions and reasoning ("Chose PostgreSQL because...") - ✅ Preferences (coding style, architecture patterns) - ✅ Constraints (API limits, security requirements) - ✅ Learned patterns from bugs/solutions **Don't store LOW-SIGNAL content**: - ❌ Code implementations
KKingZeroCLAUDE.mdKKingZero/Zypheron-CLI/zypheron-go/CLAUDE.md
tool assumes authorized usage context (pentests, red team engagements, bug bounty programs, CTF competitions, security research). ## Licensing Tiers Licensing is enforced in `internal/licensing/`. Feature gates use Cobra middleware. | Tier | Price
amirfish1CLAUDE.mdamirfish1/claude-command-center/CLAUDE.md
What needs a deploy beyond push (`scripts/macapp/`, DMG, Sparkle, `infra/telemetry-worker/`, Homebrew): `docs/agent-rules.md`. ## API and security - `/api/*` is public API: adding fields/endpoints is fine; renaming/removing/reshaping is a major bump. - Read `SECURITY.md
clawfleetCLAUDE.mdclawfleet/ClawFleet/CLAUDE.md
design decisions, project structure, and code implementation must follow best engineering practices. Specifically: ### Security & Least Privilege - Never use overly permissive settings (e.g. `chmod 0777`) as shortcuts. Solve permission problems
dredozubovCLAUDE.mddredozubov/hazmat/CLAUDE.md
canonical path + file hash. Approval is stored outside the repo in `~/.hazmat/integration-approvals.yaml`. ## When making security-relevant changes **Update docs/design-assumptions.md** if you change: - The seatbelt credential deny list - Network policy
samyama-aiCLAUDE.mdsamyama-ai/samyama-graph/CLAUDE.md
example knowledge_graph_demo # Enterprise knowledge graph cargo run --example enterprise_soc_demo # Security operations center cargo run --example agentic_enrichment_demo # GAK (Generation-Augmented Knowledge; needs `claude` CLI) cargo
SentryCLAUDE.mdgetsentry/sentry-unreal/CLAUDE.md
/ue-integration-test` - Run integration tests - `/build-deps` - Build plugin SDK dependencies locally and refresh ThirdParty binaries ### Security - Never commit secrets, credentials, API keys, or tokens to the repository - Never print or display
api7CLAUDE.mdapi7/aisix/CLAUDE.md
regression fail the assertions? - **Reliability** — races, error handling, retry/timeout, propagation timing on slow CI. - **Security** — auth/authz, input validation at boundaries, injection, header forwarding (and what's deliberately not forwarded). - **Sensitive
selfishprimateCLAUDE.mdselfishprimate/gerillass/CLAUDE.md
source zip of a GitHub release by `export-ignore` in `.gitattributes`. ## Releasing The security fix only reaches users when the npm package is republished — updating the repo alone changes nothing
dtormoenCLAUDE.mddtormoen/tsk-tsk/CLAUDE.md
base → stack → project → agent), `ProxyManager` (proxy lifecycle with per-configuration instances), `DockerManager` (container execution). Security-first with dropped capabilities and per-container network isolation. - **Server Mode** (`src/server/`): `TskServer` daemon with
severity1CLAUDE.mdseverity1/claude-agent-sdk-go/CLAUDE.md
check # Fail if complexity exceeds threshold (CI) make fmt-check # Verify code formatting make security # Run security vulnerability checks make sdk-test # Test SDK as consumer would use it make
severity1CLAUDE.mdseverity1/claude-agent-sdk-go/examples/CLAUDE.md
Agent definitions ├── 16_structured_output/ # JSON schema constraints ├── 17_plugins/ # Plugin configuration ├── 18_sandbox_security/ # Command isolation ├── 19_partial_streaming/ # Real-time delta updates ├── 20_debugging_and_diagnostics/ # Debug output
EXboysCLAUDE.mdEXboys/skilllite/CLAUDE.md
policy: `spec/task-artifact-language.md` - Spec routing and enforcement: `spec/README.md` - Architecture constraints: `spec/architecture-boundaries.md` - Rust coding conventions: `spec/rust-conventions.md` - Security constraints: `spec/security-nonnegotiables.md` - Testing policy: `spec/testing-policy.md` - Docs sync policy: `spec/docs-sync.md` - Structured-signal-first policy: `spec/structured-signal-first.md` - Task
ordewellCLAUDE.mdordewell/ordewell/CLAUDE.md
published measurement behind one ([AGENTS.md](AGENTS.md) cautions). - The planner's exploration envelope is a security boundary ([ADR-0008](docs/adr/0008-planner-exploration-envelope.md)). Do not widen what it permits without
A file Claude Code reads at the start of every session. It holds the commands, conventions and warnings the agent needs for this project.
At the repository root. Claude Code also reads CLAUDE.md files in subdirectories when it works there.
Build and test commands, the project's layout, conventions that aren't obvious from the code, and mistakes to avoid. Short files tend to work better than long ones.
Claude Code reads CLAUDE.md; most other agents read AGENTS.md. Many projects keep one and point the other at it.
