CLAUDE.md examples from real projects

xixu-meCLAUDE.md

Xget

xixu-me/Xget/CLAUDE.md

reverse proxy that transforms incoming requests to match various platform APIs while adding security headers, caching, retry logic, and performance monitoring. ## Development Commands ### Core Commands ```bash # Start development server (Cloudflare

plastic-labsReads credentialsCLAUDE.md

honcho

plastic-labs/honcho/CLAUDE.md

When enabled, every DB session carries a request-scoped `app.tenant` GUC so row-level-security policies scope reads and writes to a single tenant. `tracked_db` is then

nullclawCLAUDE.md

nullclaw

nullclaw/nullclaw/CLAUDE.md

http_util` 2. **Agent**: `agent`, `session`, `providers`, `memory` 3. **Networking**: `gateway`, `channels` 4. **Extensions**: `security`, `cron`, `health`, `tools`, `identity`, `cost`, `observability`, `heartbeat`, `runtime`, `mcp`, `subagent`, `auth`, `multimodal`, `agent_routing

deanpetersReads credentialsCLAUDE.md

Product-Manager-Skills

deanpeters/Product-Manager-Skills/CLAUDE.md

Growth Pyramid, applied through practitioner field material - ✅ **v0.79 Released (May 15, 2026):** Community contributions — security hardening, new meta-skill, bug fix - Added `skills/pm-skill-creator/` — interactive skill for guided skill design

chaos-meshCLAUDE.md

chaos-mesh

chaos-mesh/chaos-mesh/CLAUDE.md

corresponding portions of `make check`. `make gosec-scan` is a separate, non-blocking security report and is not part of `make check`. ### Code generation ```bash make generate make proto make

No other project uses it yet

leejetCLAUDE.md

stable-diffusion.cpp

leejet/stable-diffusion.cpp/CLAUDE.md

AGENTS.md` as the shared repository instructions. Do not duplicate contribution, style, PR, dependency, or security policy here; use `CONTRIBUTING.md` as the canonical source for those rules. Keep Claude-specific project

datahaven-xyzCLAUDE.md

datahaven

datahaven-xyz/datahaven/CLAUDE.md

with code in this repository. ## Project Overview DataHaven is an EVM-compatible Substrate blockchain secured by EigenLayer. It bridges Ethereum and Substrate ecosystems through: - EigenLayer AVS integration for security - Snowbridge

midudevCLAUDE.md

preguntas-entrevista-react

midudev/preguntas-entrevista-react/CLAUDE.md

make accessible". - `.claude/skills/accessibility/SKILL.md` - `.claude/skills/accessibility/references/WCAG.md` ## Best practices Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code

inventreeCLAUDE.md

InvenTree

inventree/InvenTree/CLAUDE.md

CONTRIBUTING.md](CONTRIBUTING.md) for codebase guidance. Security reports must follow the security policy in [SECURITY.md](docs/docs/SECURITY.md) and provide how they interact with the [threat model](docs/docs/concepts/threat_model.md). Do not open a pull

No other project uses it yet

OsmanticReads credentialsCLAUDE.md

ODS

Osmantic/ODS/CLAUDE.md

merges them with base + GPU overlay. Services bind to `127.0.0.1` by default for security. ### Dashboard API FastAPI app in `extensions/services/dashboard-api/` with modular routers (`routers/agents.py`, `features.py`, `privacy.py`, `setup.py`, `updates.py`, `workflows.py`). Uses

vastsaDeletes or force-pushesCLAUDE.md

PI-Desktop

vastsa/PI-Desktop/CLAUDE.md

disagree, follow `AGENTS.md`. Domain specs under `docs/spec/` remain authoritative for product behavior, protocols, and security boundaries. **Mirror sync:** This file condenses `AGENTS.md` for Claude Code. When policy changes, update both

No other project uses it yet

mnfstReads credentialsCLAUDE.md

manifest

mnfst/manifest/CLAUDE.md

Better Auth import) │ │ ├── database/ │ │ │ ├── database.module.ts # TypeORM PostgreSQL config │ │ │ ├── database-seeder.service.ts # Seeds demo data (users, agents, security events) │ │ │ ├── datasource.ts # CLI DataSource for migration commands │ │ │ ├── pricing-sync.service.ts # OpenRouter pricing data sync │ │ │ ├── ollama-sync.service.ts # Ollama model

h2oaiCLAUDE.md

h2o-3

h2oai/h2o-3/CLAUDE.md

when it's obvious (`bug`, `feature`, `docs`, `dependencies`, …). Skip if unclear. **CVE or security-related tasks must carry the `Security Vulnerability` label.** - **Relationships**: if a PR already exists

guardrails-aiCLAUDE.md

guardrails

guardrails-ai/guardrails/CLAUDE.md

IMPORTANT — always follow) This repo separates **compatibility** (what users are allowed to install) from **security** (what we actually ship and test against). The two live in different files and must

No other project uses it yet

AnthropicCLAUDE.md

defending-code-reference-harness

anthropics/defending-code-reference-harness/CLAUDE.md

Claude for Securing Source Code This repo has two halves: - **Interactive skills** (`.claude/skills/`) — read and write files in the repo (no target-code execution, except `/dnr-hunt` / `/dnr-respond`, which

enso-orgCLAUDE.md

enso

enso-org/enso/docs/CLAUDE.md

native image, dual-JVM, GraalVM upgrade, benchmarks, ydoc, logging. - `syntax/`, `semantics/`, `types/` — Language specification. - `security/`, `SECURITY.md` — Vulnerability reporting + policies. ## When to update - **New feature** → add to the subsystem

No other project uses it yet

TencentCLAUDE.md

AI-Infra-Guard

Tencent/AI-Infra-Guard/CLAUDE.md

rules organized by component - `data/eval/` — 13+ JSON jailbreak evaluation datasets - `data/mcp/` — YAML MCP security scan plugin rules ### Python Sub-projects These are invoked as subprocesses by Go agents, each

No other project uses it yet

jokob-skCLAUDE.md

NetAlertX

jokob-sk/NetAlertX/CLAUDE.md

assumption that's wrong once two async steps are both in play. - **Bug and security fixes are test-first: write the failing test, run it and see it fail

kyegomezReads credentialsCLAUDE.md

swarms

kyegomez/swarms/CLAUDE.md

this many times max_loops=1, ) result = moa.run("What are the best practices for securing a Kubernetes cluster?") ``` **When to use:** High-stakes tasks where you want multiple independent perspectives

Serial-StudioCLAUDE.md

Serial-Studio

Serial-Studio/Serial-Studio/CLAUDE.md

before handoff.** Re-read the diff: is this *what was asked, and only that*? - **Security-sensitive surfaces are decision-visible.** `app/src/Licensing/`, `core/Core/Licensing/`, `MachineID`, and the API Server auth/consent files