CLAUDE.md examples from real projects

decoluaReads credentialsCLAUDE.md

9router

decolua/9router/CLAUDE.md

forwarding headers only from a loopback reverse proxy. Preserve this when touching request/IP/rate-limit code. - Security-sensitive env: `JWT_SECRET` (session cookie), `INITIAL_PASSWORD` (default `123456` — must override), `API_KEY_SECRET

No other project uses it yet

Zackriya-SolutionsCLAUDE.md

meetily

Zackriya-Solutions/meetily/CLAUDE.md

reintroduce the archived FastAPI backend as a supported requirement. 5. **Legacy FastAPI Security Context**: The archived FastAPI/CORS behavior is unsupported legacy code and must not be treated as a supported

supermemoryaiCLAUDE.md

supermemory

supermemoryai/supermemory/CLAUDE.md

shared packages - Database migrations handled through Drizzle Kit - Schema types automatically generated and shared ## Security & Best Practices ### Authentication - Better Auth handles user authentication and organization management - API key authentication

garrytanCLAUDE.md

gbrain

garrytan/gbrain/CLAUDE.md

false` set by `src/cli.ts`) from untrusted agent-facing callers (`remote: true` set by `src/mcp/server.ts`). Security-sensitive operations like `file_upload` tighten filesystem confinement when `remote=true` and default to strict

No other project uses it yet

qwibitaiReads credentialsCLAUDE.md

nanoclaw

qwibitai/nanoclaw/CLAUDE.md

install timezone. Resolution: `resolveGroupTimezone` in `src/container-config.ts` — group override → install global. ## Supply Chain Security (pnpm) This project uses pnpm with `minimumReleaseAge: 4320` (3 days) in `pnpm-workspace.yaml`. New package versions must exist

trailofbitsReads credentialsCLAUDE.md

algo

trailofbits/algo/CLAUDE.md

that sets up a personal VPN in the cloud. It's designed to be: - **Security-focused**: Creates hardened VPN servers with minimal attack surface - **Easy to use**: Automated deployment with

No other project uses it yet

simstudioaiCLAUDE.md

sim

simstudioai/sim/CLAUDE.md

never `crypto.randomUUID()`, `nanoid`, or `uuid`. Both use `crypto.getRandomValues()`, so they also work in non-secure (HTTP) browsers. For other randomness, `@sim/utils/random` (`randomInt`, `randomFloat`, `randomItem`, `generateRandomBytes`, `generateRandomHex`) — never `Math.random()` or `crypto.randomBytes

alirezarezvaniReads credentialsCLAUDE.md

claude-skills

alirezarezvani/claude-skills/CLAUDE.md

role forcing questions. v2.7.3 ports `alirezarezvani/aeo-box` — AEO (Answer Engine Optimization) skill into marketing-skill/ + security-guidance PreToolUse hook into engineering/. v2.7.0 added 13 Path-B skills across 3 top-level

alirezarezvaniCLAUDE.md

claude-skills / engineering-team

alirezarezvani/claude-skills/engineering-team/CLAUDE.md

frontend, senior-backend, senior-fullstack - senior-qa, senior-devops, senior-secops - code-reviewer, senior-security - aws-solution-architect, ms365-tenant-manager, google-workspace-cli, tdd-guide, tech-stack-evaluator, epic

alirezarezvaniCLAUDE.md

claude-skills / project-management

alirezarezvani/claude-skills/project-management/CLAUDE.md

atlassian-admin/`) **Focus:** Suite administration, user management, integrations **Scripts:** - `scripts/permission_audit_tool.py` — Analyzes permission schemes for security gaps **Key Workflows:** - User provisioning and permissions - SSO/SAML configuration - App marketplace management - Performance monitoring ### Atlassian

No other project uses it yet

alirezarezvaniCLAUDE.md

claude-skills / ra-qm-team

alirezarezvani/claude-skills/ra-qm-team/CLAUDE.md

CAPA system management, root cause analysis - quality-documentation-manager - DHF, DMR, DHR management **Risk & Security (2 skills):** - risk-management-specialist - ISO 14971 compliance, risk analysis - information-security-manager-iso27001

alirezarezvaniCLAUDE.md

claude-skills / standards

alirezarezvani/claude-skills/standards/CLAUDE.md

workflow, conventional commits, branching strategy 4. **documentation/** - Markdown quality, structure consistency, living docs 5. **security/** - Secret detection, dependency security, input validation ## When to Reference Standards ### Communication Standards **Reference when:** - Writing

swagger-apiCLAUDE.md

swagger-ui

swagger-api/swagger-ui/CLAUDE.md

swagger-client 3.36.0 - OpenAPI client - js-yaml 4.1.1 - YAML parsing - remarkable 2.0.1 - Markdown rendering **Security:** - DOMPurify 3.2.6 - HTML sanitization (CRITICAL for XSS prevention) - serialize-error 8.1.0 - Error serialization **Build Tools

No other project uses it yet

DonchitosCLAUDE.md

Claude-Code-Game-Studios / studio-tests

Donchitos/Claude-Code-Game-Studios/studio-tests/CLAUDE.md

check, content-audit, code-review, tech-debt, scope-check, estimate, perf-profile, asset-audit, security-audit, test-evidence-review, test-flakiness team → team-combat, team-narrative, team-audio, team-level

No other project uses it yet

OpenZeppelinCLAUDE.md

openzeppelin-contracts

OpenZeppelin/openzeppelin-contracts/CLAUDE.md

deciding whether a feature belongs in the library — open an issue first. - Security assessments or audit opinions. - New ERC interfaces or standards without explicit direction. - Restructuring tests without a corresponding

VoltAgentCLAUDE.md

awesome-claude-code-subagents

VoltAgent/awesome-claude-code-subagents/CLAUDE.md

specialists/ # Language/framework experts (TypeScript, Python, etc.) 03-infrastructure/ # DevOps, cloud, Kubernetes, etc. 04-quality-security/ # Testing, security auditing, code review 05-data-ai/ # ML, data engineering, AI specialists 06-developer

JimLiuPipes a download into a shellCLAUDE.md

baoyu-skills

JimLiu/baoyu-skills/CLAUDE.md

Gemini Web auth**: Browser cookies (first run opens Chrome for login, `--login` to refresh) ## Security - **No piped shell installs**: Never `curl | bash`. Use `brew install` or `npm install -g` - **Remote

No other project uses it yet

activepiecesDeletes or force-pushesCLAUDE.md

activepieces

activepieces/activepieces/CLAUDE.md

auto-discover. - **HTTP**: `POST` for all create/update mutations. `DELETE` for deletes. Never PUT/PATCH. - **Security**: Every endpoint needs `securityAccess` config. - **Side effects**: Separated into `*-side-effects.ts` files, called explicitly after mutations. - **Multi

No other project uses it yet

apacheCLAUDE.md

skywalking

apache/skywalking/CLAUDE.md

Rare exceptions: propagating OpenTelemetry context where the whole industry has standardised on `ThreadLocal`, or security principals enforced by a framework. In all other cases, prefer an explicit API extension, even

No other project uses it yet

gitlabhqCLAUDE.md

gitlabhq

gitlabhq/gitlabhq/CLAUDE.md

real fix requires either, say so and explain why instead of doing it silently. - **Security fixes** — treat an issue as requiring a special security fix when the issue is confidential

No other project uses it yet