CLAUDE.md examples from real projects

getpaseoCLAUDE.md

paseo

getpaseo/paseo/CLAUDE.md

docs/docker.md](docs/docker.md) | Running the daemon and bundled web UI in Docker, volumes, agent images, security | | [docs/release.md](docs/release.md) | Release playbook, draft releases, completion checklist | | [docs/terminal-worker.md](docs/terminal-worker.md) | Terminal worker process model, socket/record/secret

No other project uses it yet

microCLAUDE.md

go-micro

micro/go-micro/CLAUDE.md

Patterns for agent-friendly error responses - **Documentation Guides** - Six guides: AI-native services, MCP security, tool descriptions, agent patterns, error handling, troubleshooting - **WithMCP Option** - One-line MCP setup (`gateway/mcp/option.go`) - **Agent

No other project uses it yet

QwikDevCLAUDE.md

qwik

QwikDev/qwik/CLAUDE.md

unit.ts(x)` | Vitest unit files | | `*.spec.ts(x)` | Vitest spec files | | `*.e2e.ts` | Playwright e2e files | ### Security And Supply Chain Treat security-sensitive changes as behavior changes even when they look like

No other project uses it yet

eclipse-theiaCLAUDE.md

theia

eclipse-theia/theia/CLAUDE.md

issues, and comments **brief and concise** — no padding, marketing language, or restating the diff. - **Security:** never disclose vulnerabilities via a GitHub issue or PR — report them per `SECURITY.md`. Such issues

No other project uses it yet

onnxCLAUDE.md

onnx

onnx/onnx/CLAUDE.md

tooling) are fine as a normal public issue or PR, but a non-trivial security vulnerability must be reported privately via GitHub Security Advisories, not a public issue. ## Project Norms

No other project uses it yet

wekanCLAUDE.md

wekan

wekan/wekan/CLAUDE.md

pull request ITSELF is the participant, and is named.** GitHub CodeQL filing a security fix, Copilot Autofix, Dependabot raising a dependency bump: nobody wrote those, so crediting a human would

No other project uses it yet

bitwardenCLAUDE.md

server

bitwarden/server/.claude/CLAUDE.md

passwords, keys, or vault data in logs or error messages - **ALWAYS** use secure communication channels: Enforce confidentiality, integrity, and authenticity - **ALWAYS** encrypt sensitive data: All vault data must be encrypted

No other project uses it yet

AgriciDanielReads credentialsCLAUDE.md

claude-seo

AgriciDaniel/claude-seo/CLAUDE.md

Image gen reference files (7 files) agents/ # 19 subagents (auto-discovered) seo-technical.md # Crawlability, indexability, security seo-content.md # E-E-A-T, readability, thin content seo-schema.md # Structured data validation seo-sitemap.md # Sitemap quality

No other project uses it yet

AnthropicReads credentialsCLAUDE.md

claude-quickstarts / self-hosted-sandboxes

anthropics/claude-quickstarts/managed-agents/self-hosted-sandboxes/CLAUDE.md

demo working. `make status` and `state/ledger.jsonl` show every decision. On a Mac where endpoint security blocks OpenShell's binaries, the README's "Running the gateway in Docker" runs the gateway

No other project uses it yet

ahmedkhaleel2004Reads credentialsCLAUDE.md

gitdiagram

ahmedkhaleel2004/gitdiagram/CLAUDE.md

cookie) and per connection, in Redis, failing closed. These are access rules, not a security boundary (a VPN passes). Only the operator may regenerate an existing video. - **Paid videos** (`payments.ts

No other project uses it yet

gnachmanCLAUDE.md

iTerm2 / WebExtensionsFramework

gnachman/iTerm2/WebExtensionsFramework/CLAUDE.md

what code needs to be on the main actor * Think carefully about edge cases * Security is paramount. The web is a hostile platform and we must be very careful

No other project uses it yet

nodemailerCLAUDE.md

nodemailer

nodemailer/nodemailer/CLAUDE.md

src/mime-node/` - message -> MIME tree -> raw RFC822 stream. - `src/smtp-connection/` - low-level SMTP/LMTP/ESMTP client. Hot path; security-sensitive. Used by `smtp-transport` and `smtp-pool`. - `src/smtp-transport/` - single-shot SMTP transport. - `src/smtp-pool/` - pooled

No other project uses it yet

questdbCLAUDE.md

questdb

questdb/questdb/CLAUDE.md

Enhancement`, `Flaky Test`, `ILP`, `Materialized View`, `New feature`, `Performance`, `Postgres Wire`, `REST API`, `SQL`, `Security`, `UI`, `WAL`, `Windows`, `regression`, `rust`, `storage`. - Use active voice in commit messages, PR descriptions

No other project uses it yet

joewalnesCLAUDE.md

websocketd

joewalnes/websocketd/CLAUDE.md

docs-archive/`. ## Changelog Update `CHANGES` before committing if the change affects: - Dependencies (especially security fixes) - User-visible behavior, CLI flags, or defaults - New features or test infrastructure - Bug fixes referenced

No other project uses it yet

javascript-obfuscatorCLAUDE.md

javascript-obfuscator

javascript-obfuscator/javascript-obfuscator/CLAUDE.md

# JavaScript Obfuscator - Project Documentation ## Project Overview **JavaScript Obfuscator** is a powerful, enterprise-grade code

No other project uses it yet

GreyDGLCLAUDE.md

PentestGPT

GreyDGL/PentestGPT/CLAUDE.md

Runtime contract - The Supervisor and Executor both use `SandboxPolicy.FULL_ACCESS`; deployment isolation is the security boundary. - Each episode is fresh. SQLite and exact trace receipts—not provider conversation history

No other project uses it yet

saltstackCLAUDE.md

salt / agents

saltstack/salt/agents/CLAUDE.md

options (test mode, minion ID, etc.) - `__grains__` - System information (OS, platform, custom data) - `__pillar__` - Secure data for this minion - `__context__` - Per-run cache (persists during Salt execution) **Module-Specific:** - `__salt

No other project uses it yet

mauriceboeReads credentialsCLAUDE.md

NOMAD

mauriceboe/NOMAD/CLAUDE.md

subsystems (providers, pipes, guards, `@nestjs/schedule`) over hand-rolled equivalents. - **Fail closed, gates stay on.** Security switches default to safe; misconfiguration must refuse, not degrade. Never lower a quality gate

mauriceboeCLAUDE.md

NOMAD / client

mauriceboe/NOMAD/client/CLAUDE.md

isEffectivelyOffline()` is the single source of truth — never read `navigator.onLine` in feature code. - **Rendering security**: never interpolate user content into HTML strings (map popups included — build via DOM + `textContent

mauriceboeCLAUDE.md

NOMAD / plugin-sdk

mauriceboe/NOMAD/plugin-sdk/CLAUDE.md

plugin's `client/index.html` (the opaque-origin iframe CSP forbids external link/script). Not a security boundary. - **`src/lucide-icon-names.ts`** — generated snapshot; an unknown icon is a validate **warning**, never an error. - **`test/helpers.ts`** — `makePublishable