CLAUDE.md examples from real projects

plotlyCLAUDE.md

dash

plotly/dash/CLAUDE.md

front: - `COMMANDS.md` - build, test, lint commands - `ARCHITECTURE.md` - backend, callbacks, pages, background callbacks, stores, async, security - `RENDERER.md` - frontend, crawlLayout, Redux store, clientside API - `COMPONENTS.md` - component system, generation, resources - `TESTING.md` - test framework

No other project uses it yet

microCLAUDE.md

go-micro

micro/go-micro/CLAUDE.md

Patterns for agent-friendly error responses - **Documentation Guides** - Six guides: AI-native services, MCP security, tool descriptions, agent patterns, error handling, troubleshooting - **WithMCP Option** - One-line MCP setup (`gateway/mcp/option.go`) - **Agent

No other project uses it yet

getpaseoCLAUDE.md

paseo

getpaseo/paseo/CLAUDE.md

docs/docker.md](docs/docker.md) | Running the daemon and bundled web UI in Docker, volumes, agent images, security | | [docs/release.md](docs/release.md) | Release playbook, draft releases, completion checklist | | [docs/terminal-worker.md](docs/terminal-worker.md) | Terminal worker process model, socket/record/secret

QwikDevCLAUDE.md

qwik

QwikDev/qwik/CLAUDE.md

unit.ts(x)` | Vitest unit files | | `*.spec.ts(x)` | Vitest spec files | | `*.e2e.ts` | Playwright e2e files | ### Security And Supply Chain Treat security-sensitive changes as behavior changes even when they look like

No other project uses it yet

eclipse-theiaCLAUDE.md

theia

eclipse-theia/theia/CLAUDE.md

issues, and comments **brief and concise** — no padding, marketing language, or restating the diff. - **Security:** never disclose vulnerabilities via a GitHub issue or PR — report them per `SECURITY.md`. Such issues

No other project uses it yet

onnxCLAUDE.md

onnx

onnx/onnx/CLAUDE.md

tooling) are fine as a normal public issue or PR, but a non-trivial security vulnerability must be reported privately via GitHub Security Advisories, not a public issue. ## Project Norms

No other project uses it yet

wekanCLAUDE.md

wekan

wekan/wekan/CLAUDE.md

pull request ITSELF is the participant, and is named.** GitHub CodeQL filing a security fix, Copilot Autofix, Dependabot raising a dependency bump: nobody wrote those, so crediting a human would

No other project uses it yet

bitwardenCLAUDE.md

server

bitwarden/server/.claude/CLAUDE.md

passwords, keys, or vault data in logs or error messages - **ALWAYS** use secure communication channels: Enforce confidentiality, integrity, and authenticity - **ALWAYS** encrypt sensitive data: All vault data must be encrypted

No other project uses it yet

AgriciDanielReads credentialsCLAUDE.md

claude-seo

AgriciDaniel/claude-seo/CLAUDE.md

Image gen reference files (7 files) agents/ # 19 subagents (auto-discovered) seo-technical.md # Crawlability, indexability, security seo-content.md # E-E-A-T, readability, thin content seo-schema.md # Structured data validation seo-sitemap.md # Sitemap quality

No other project uses it yet

storytoldCLAUDE.md

pdfcraft

storytold/pdfcraft/CLAUDE.md

change by hundreds of lines under a branch. - **External PRs are held to safety, security and completeness before style.** Provenance first (no Adobe-derived asset, no committed font, no copied

ahmedkhaleel2004Reads credentialsCLAUDE.md

gitdiagram

ahmedkhaleel2004/gitdiagram/CLAUDE.md

cookie) and per connection, in Redis, failing closed. These are access rules, not a security boundary (a VPN passes). Only the operator may regenerate an existing video. - **Paid videos** (`payments.ts

No other project uses it yet

emcie-coCLAUDE.md

parlant

emcie-co/parlant/CLAUDE.md

built for enterprise, large-scale use cases, where SLAs, stability and security are paramount The repo's structure follows the Hexagonal Architecture (Ports and Adapters) approach. - src/parlant - core: Core framework

No other project uses it yet

gnachmanCLAUDE.md

iTerm2 / WebExtensionsFramework

gnachman/iTerm2/WebExtensionsFramework/CLAUDE.md

what code needs to be on the main actor * Think carefully about edge cases * Security is paramount. The web is a hostile platform and we must be very careful

No other project uses it yet

nodemailerCLAUDE.md

nodemailer

nodemailer/nodemailer/CLAUDE.md

src/mime-node/` — message → MIME tree → raw RFC822 stream. - `src/smtp-connection/` — low-level SMTP/LMTP/ESMTP client. Hot path; security-sensitive. Used by `smtp-transport` and `smtp-pool`. - `src/smtp-transport/` — single-shot SMTP transport. - `src/smtp-pool/` — pooled

No other project uses it yet

questdbCLAUDE.md

questdb

questdb/questdb/CLAUDE.md

Enhancement`, `Flaky Test`, `ILP`, `Materialized View`, `New feature`, `Performance`, `Postgres Wire`, `REST API`, `SQL`, `Security`, `UI`, `WAL`, `Windows`, `regression`, `rust`, `storage`. - Use active voice in commit messages, PR descriptions

joewalnesCLAUDE.md

websocketd

joewalnes/websocketd/CLAUDE.md

docs-archive/`. ## Changelog Update `CHANGES` before committing if the change affects: - Dependencies (especially security fixes) - User-visible behavior, CLI flags, or defaults - New features or test infrastructure - Bug fixes referenced

No other project uses it yet

javascript-obfuscatorCLAUDE.md

javascript-obfuscator

javascript-obfuscator/javascript-obfuscator/CLAUDE.md

# JavaScript Obfuscator - Project Documentation ## Project Overview **JavaScript Obfuscator** is a powerful, enterprise-grade code

No other project uses it yet

GreyDGLCLAUDE.md

PentestGPT

GreyDGL/PentestGPT/CLAUDE.md

Runtime contract - The Supervisor and Executor both use `SandboxPolicy.FULL_ACCESS`; deployment isolation is the security boundary. - Each episode is fresh. SQLite and exact trace receipts—not provider conversation history

No other project uses it yet

spreeReads credentialsCLAUDE.md

spree

spree/spree/CLAUDE.md

will be used in unexpected ways, and that users may try to break it. Security is another important aspect of development, and we should always be mindful of potential vulnerabilities

No other project uses it yet

saltstackCLAUDE.md

salt / agents

saltstack/salt/agents/CLAUDE.md

options (test mode, minion ID, etc.) - `__grains__` - System information (OS, platform, custom data) - `__pillar__` - Secure data for this minion - `__context__` - Per-run cache (persists during Salt execution) **Module-Specific:** - `__salt

No other project uses it yet