CLAUDE.md examples from real projects

rundeckCLAUDE.md

rundeck

rundeck/rundeck/CLAUDE.md

Groovy auto-generates getters/setters — do NOT implement them explicitly unless custom logic is needed. ### Security Avoid command injection, XSS, SQL injection. Use parameterized queries and escape user input. ### Simplicity Only

No other project uses it yet

Q00CLAUDE.md

ouroboros

Q00/ouroboros/CLAUDE.md

introduced by this PR? 5. If scope is split, does immediate user-data or security risk remain? Use these decisions: - Q1 + Q2: **Changes Requested**. - Q3 + Q5: stop and revisit

No other project uses it yet

wiltodeltaCLAUDE.md

remove-ai-watermarks

wiltodelta/remove-ai-watermarks/CLAUDE.md

binding registry snapshot is stale; rerun it without `--check` to refresh the snapshot. Triaged security blocks and their recheck procedure, environment recovery, CI behavior, and fixture policy live in [`docs/development.md

No other project uses it yet

HeliconeCLAUDE.md

helicone

Helicone/helicone/CLAUDE.md

useJawnClient()` ### Database - PostgreSQL with snake_case naming - ClickHouse for analytics - Proper RLS policies for security ## Tech Stack ### Frontend - Next.js 14 with React 18.3.1 - TypeScript, Tailwind CSS, Radix UI - Zustand

No other project uses it yet

appleboyCLAUDE.md

ssh-action

appleboy/ssh-action/CLAUDE.md

Docker containers (tests `./` local action) - `.github/workflows/stable.yml` - Tests against published `appleboy/ssh-action@v1` tag - `.github/workflows/trivy-scan.yml` - Automated security scanning for vulnerabilities and misconfigurations ## Testing ### Running Tests Tests run automatically via GitHub Actions workflows

No other project uses it yet

eberttiCLAUDE.md

awesome-telegram

ebertti/awesome-telegram/CLAUDE.md

links) - The entry is a crypto trading bot that requests API keys via Telegram (security risk) - The content appears to be self-promotion of paid/adult/gated content groups - The PR title

apacheCLAUDE.md

pinot

apache/pinot/CLAUDE.md

requested full reviews and changes that benefit from independent domain review, especially compatibility, concurrency, security, and distributed state changes. Small changes can be reviewed directly. Reuse review evidence while

fengshao1227CLAUDE.md

ccg-workflow / templates

fengshao1227/ccg-workflow/templates/CLAUDE.md

docs` | 新建模块 → 生成 README.md + DESIGN.md 骨架 | | `verify-module/` | `/ccg:verify-module` | 模块完成后 → 扫描结构完整性 | | `verify-security/` | `/ccg:verify-security` | 新模块/安全变更/重构 → 漏洞扫描 | | `verify-change/` | `/ccg:verify-change` | >30 行变更 → 文档同步状态分析

No other project uses it yet

hacdiasCLAUDE.md

webdav

hacdias/webdav/.claude/CLAUDE.md

CLAUDE.md Guidance for Claude when working in this repository (`hacdias/webdav`). ## Handling security advisories Advisory state lives on GitHub and is driven with the `gh` CLI: `triage → draft → published`, plus `closed

No other project uses it yet

CountlyCLAUDE.md

countly-server

Countly/countly-server/CLAUDE.md

plugin tests countly plugin lint name # Lint plugin countly shellcheck # Validate shell scripts ``` ## Critical Security Rules **ALWAYS follow these - no exceptions:** 1. **API endpoints must use validation**: ```javascript const { validateRead

coleam00CLAUDE.md

ottomator-agents / claude-skill-archon

coleam00/ottomator-agents/claude-skill-archon/CLAUDE.md

Include helper scripts**: Python, shell, etc. in `scripts/` - **Use `allowed-tools`**: Restrict tools when security matters - **Show error handling**: Demonstrate proper error patterns - **Add type hints**: Make Python code clear

VercelCLAUDE.md

streamdown / website

vercel/streamdown/apps/website/.claude/CLAUDE.md

Prefer simple conditionals over nested ternary operators - Group related code together and separate concerns ### Security - Add `rel="noopener"` when using `target="_blank"` on links - Avoid `dangerouslySetInnerHTML` unless absolutely necessary

No other project uses it yet

alibabaCLAUDE.md

QLExpress

alibaba/QLExpress/CLAUDE.md

QLInstruction` 子类 | | **数据体系** | `runtime/data/` | 值类型和类型转换 | `Value`, `DataValue`, `ObjTypeConvertor` | | **上下文** | `runtime/context/` | 脚本执行环境 | `ExpressContext`, 多种实现 | | **安全策略** | `security/` | 反射安全隔离 | `QLSecurityStrategy`, 4 种策略 | | **执行追踪** | `runtime/trace/` | 表达式执行路径记录 | `ExpressionTrace`, `TracePointTree` | --- ## 3. 主要的包和类的组织方式 ### 3.1 分层结构 ``` 表现层

zenml-ioCLAUDE.md

zenml

zenml-io/zenml/CLAUDE.md

reuse opportunities, quality issues, and efficiency improvements. Fix any issues it finds before committing. ### Security Guidelines - **NEVER** commit secrets, API keys, tokens, or passwords - Use environment variables or ZenML

shuvonsecCLAUDE.md

claude-bug-bounty

shuvonsec/claude-bug-bounty/CLAUDE.md

none/confusion/crack), OOB blind-bug confirmation (interactsh), LLM red-team corpus | | `skills/mcp-server-audit/` | MCP server security — tool poisoning, param→sink injection (path/cmd/SSRF/SQL), missing approval gates, result-channel secret leaks, rug-pull/confused-deputy

0xebCLAUDE.md

TheBigPromptLibrary

0xeb/TheBigPromptLibrary/.claude/CLAUDE.md

content is primarily markdown documentation for educational purposes around prompt engineering and LLM security research. ## Repository Structure - **SystemPrompts/** - System prompts from various LLM providers (OpenAI, Anthropic, Google, Meta

trustwalletCLAUDE.md

assets

trustwallet/assets/CLAUDE.md

architecture, build, conventions, core-libs, decisions, design, features, git-conventions, guides, observability, product, quality, security, tests, workflows, brand, business, legal, hr, prompts, api, libs, components, references ## Constraints - [TODO: Add project

spiegltCLAUDE.md

FlyingCarpet

spieglt/FlyingCarpet/CLAUDE.md

never reuse, never user-chosen, never "remember." The entire "offline crack is worthless" security argument depends on this (see the crypto doc §7). The discovery HMAC key is derived from

breaking-brakeCLAUDE.md

cc-wf-studio

breaking-brake/cc-wf-studio/CLAUDE.md

effect refactors) is out of scope for agents. Maintenance is interrupt-only: red CI, security, human-reported bugs. - Two skills drive it: `next-idea` (ideation — files locked `idea` issues, never

entireioCLAUDE.md

cli

entireio/cli/CLAUDE.md

docs/architecture/agent-guide.md), [integration checklist](docs/architecture/agent-integration-checklist.md) | | External commands or agents | [External commands](docs/architecture/external-commands.md), [agent protocol](docs/architecture/external-agent-protocol.md) | | Security, privacy, scanners | [Security and privacy](docs/security-and-privacy.md), [implementation contracts](docs/development/checkpoint-implementation.md) | | Review command | [Review architecture](docs/architecture/review-command.md) | | Release

No other project uses it yet