CLAUDE.md examples from real projects

highlightCLAUDE.md

highlight

highlight/highlight/CLAUDE.md

delve debugger on port 2345 - **Performance**: ClickHouse is used for high-volume analytics queries - **Security**: CORS is configured differently for public vs private endpoints

bigbluebuttonCLAUDE.md

bigbluebutton

bigbluebutton/bigbluebutton/CLAUDE.md

Agent Instructions ## 🔒 Security Policy — Read Before Any PR If you are preparing a pull request that involves: - A bug that could be exploited - Authentication, authorization, or cryptography changes - Dependency updates

keybaseCLAUDE.md

client

keybase/client/CLAUDE.md

three reviews against the diff before it is pushed: `/code-review high` (correctness), `/security-review` (security), and a simplification pass (`/simplify`, or read-only review agents for a large stack: duplicated helpers

davidkimaiCLAUDE.md

Context-Engineering

davidkimai/Context-Engineering/CLAUDE.md

paths" }, /evaluate{ quality="Assess code quality and best practices", performance="Identify potential performance issues", security="Spot potential security concerns", maintainability="Evaluate long-term maintainability" }, /summarize{ purpose="Describe the code

firezoneCLAUDE.md

firezone

firezone/firezone/CLAUDE.md

syntactically correct. - Focus on consistency and correctness. - Give extra special attention to any security-sensitive code, such as cryptographic operations, authentication logic, and access control mechanisms. ## Code contributions - Use [Conventional

securegoCLAUDE.md

gosec

securego/gosec/CLAUDE.md

gosec - Go Security Checker gosec is a Go static analysis tool that inspects Go source code for security vulnerabilities by scanning the Go AST and SSA form. ## Build & Test ```bash

Hiram-WongCLAUDE.md

zyfun

Hiram-Wong/zyfun/CLAUDE.md

typeName'); // get user data path getUserPath('typeName'); // get system data path ``` ### UI Design - TDesign ## Security - Never expose Node.js APIs directly to renderer; use `contextBridge` in preload - Validate all IPC inputs

lollipopkitReads credentialsCLAUDE.md

flutter_server_box / monitor

lollipopkit/flutter_server_box/monitor/CLAUDE.md

ticket** (`api/ws/ticket.rs`): purpose-bound, ~30 s, burned even on a wrong secret. - **`is_secure_transport` treats loopback as secure** and never reads `X-Forwarded-Proto`. - **Terminal sessions outlive the socket

fissionCLAUDE.md

fission

fission/fission/CLAUDE.md

claude/resources/fission-*.md`, loaded on demand by the generic CI/dep/triage skills (`debug-ci`, `go-deps-security-sweep`, `bump-ci-tool-versions`, etc.). Start there when

PydanticCLAUDE.md

monty

pydantic/monty/CLAUDE.md

model-checks` and `cargo test -p monty-fs` on Linux, macOS, and Windows ## Important Security Notice It's ABSOLUTELY CRITICAL that there's no way for code

digoalCLAUDE.md

blog

digoal/blog/CLAUDE.md

AI/ML integration with databases - "德说" (德哥's personal insights on tech, economics, philosophy) - Database security, HA, performance tuning - Database source code learning series (源码入门学习) ## Adding New Content 1. **New blog

AnthropicCLAUDE.md

claude-agent-sdk-python

anthropics/claude-agent-sdk-python/CLAUDE.md

Type definitions - `_internal/` - Internal implementation details - `transport/subprocess_cli.py` - CLI subprocess management - `message_parser.py` - Message parsing logic # Security hardening for GitHub Actions Workflow jobs in this repository that call Claude run with three

bitsandbytes-foundationCLAUDE.md

bitsandbytes

bitsandbytes-foundation/bitsandbytes/CLAUDE.md

vLLM depend on bitsandbytes (for assessing downstream impact) 6. `agents/security_guide.md` — Trust model and security checklist (especially for external contributor PRs) For CUDA kernel changes, also read `agents/kbit_gemm_context.md`. The PR review

No other project uses it yet

NomicFoundationCLAUDE.md

hardhat

NomicFoundation/hardhat/CLAUDE.md

Scoped docs to read - If changing anything in ./scripts/, read ./scripts/README.md first. - Before any security review or audit, read ./THREAT_MODEL.md first and follow it. ## Renovate Config When editing `renovate.json`, validate

six2dezReads credentialsCLAUDE.md

reconftw

six2dez/reconftw/CLAUDE.md

comprehensive bash-based reconnaissance automation framework used by bug bounty hunters, penetration testers, and security researchers. It orchestrates 70+ external security tools (Go, Python, Rust) across subdomain enumeration, web probing

EstrellaXDCLAUDE.md

Auto_Bangumi

EstrellaXD/Auto_Bangumi/CLAUDE.md

notification/ # Notification plugins (Telegram, Bark, etc.) │ ├── conf/ # Configuration management, settings │ ├── network/ # HTTP client utilities │ └── security/ # JWT authentication webui/src/ ├── api/ # Axios API client functions ├── components/ # Vue components (basic/, layout/, setting/) ├── pages

joemccannReads credentialsCLAUDE.md

dillinger

joemccann/dillinger/CLAUDE.md

setError('Failed to fetch repos') } finally { setLoading(false) } }, []) return { repos, loading, error, fetchRepos } } ``` ## Security Guidelines ### XSS Prevention - **Always** sanitize user-generated HTML with DOMPurify before rendering - Markdown preview uses `dangerouslySetInnerHTML

samberCLAUDE.md

awesome-prometheus-alerts

samber/awesome-prometheus-alerts/CLAUDE.md

Kubernetes, Nomad, Consul, Etcd, OpenStack), CI/CD (Jenkins, ArgoCD, FluxCD, GitLab CI, Spinnaker), network and security (SSL/TLS, CoreDNS, Vault, Cloudflare, Cilium, eBPF), storage (Ceph, ZFS, OpenEBS, Minio), cloud providers (AWS, Azure

xixu-meCLAUDE.md

Xget

xixu-me/Xget/CLAUDE.md

reverse proxy that transforms incoming requests to match various platform APIs while adding security headers, caching, retry logic, and performance monitoring. ## Development Commands ### Core Commands ```bash # Start development server (Cloudflare

plastic-labsReads credentialsCLAUDE.md

honcho

plastic-labs/honcho/CLAUDE.md

When enabled, every DB session carries a request-scoped `app.tenant` GUC so row-level-security policies scope reads and writes to a single tenant. `tracked_db` is then