CLAUDE.md examples from real projects

umbracoCLAUDE.md

Umbraco-CMS

umbraco/Umbraco-CMS/CLAUDE.md

APIs use **OpenIddict** (OAuth 2.0/OpenID Connect): - Reference tokens (not JWT) for better security - **Secure cookie-based token storage** (v17+) - tokens stored in HTTP-only cookies with `__Host-` prefix - Tokens

nibzardCLAUDE.md

awesome-agentic-patterns

nibzard/awesome-agentic-patterns/CLAUDE.md

Original Creator (Source)"] category: "Orchestration & Control | Context & Memory | Feedback Loops | Learning & Adaptation | Reliability & Eval | Security & Safety | Tool Use & Environment | UX & Collaboration | Uncategorized" source: "URL to primary source" tags: [relevant, keywords

rivet-devCLAUDE.md

agent-os

rivet-dev/agent-os/CLAUDE.md

enter default builds, CI, publication, or behavioral-parity requirements without a separately approved design. ## Security Model Trust model: - **Client**: trusted, except for code/payloads it submits for execution. - **Sidecar/runtime**: trusted enforcement

SaffsanityCLAUDE.md

sill

Saffsanity/sill/CLAUDE.md

other languages and dictation (#147), the thumbnail hold (#248), Aa's Off (#181), the security fixes of 2026-10-29, the tour once more and a locked

JetBrainsCLAUDE.md

koog / a2a

JetBrains/koog/a2a/CLAUDE.md

task updates - **Multiple Transport Protocols**: JSON-RPC, HTTP+JSON/REST with extensibility for gRPC - **Authentication & Security**: OpenAPI 3.0 compatible security schemes ### Submodules Architecture 1. **a2a-core**: Core abstractions, data models

No other project uses it yet

bjarneoPipes a download into a shellCLAUDE.md

cliamp

bjarneo/cliamp/CLAUDE.md

make coverage` | Tests with a coverage profile and a summary for each function | | `make security` | `govulncheck ./...` | | `make ci` | What CI runs: `fmt-check`, `tidy-check`, `vet`, `staticcheck`, `security`, race tests

No other project uses it yet

taikoxyzCLAUDE.md

taiko-mono

taikoxyz/taiko-mono/CLAUDE.md

DevTools and SvelteKit's built-in debugging - **General**: Use proper debuggers over console.log debugging ## 🔒 Security Best Practices - Never commit sensitive data (private keys, API keys, etc.) - Always validate user inputs

kstenerudPipes a download into a shellCLAUDE.md

KSCrash / Benchmarks

kstenerud/KSCrash/Benchmarks/CLAUDE.md

mise install` (installs Tuist version from config) - **Trust config**: `mise trust` (required once for security) - **Run Tuist**: `mise exec -- tuist ` or activate mise in your shell ## Benchmarks Workflow ### Quick Start

No other project uses it yet

kstenerudPipes a download into a shellCLAUDE.md

KSCrash / Samples

kstenerud/KSCrash/Samples/CLAUDE.md

mise install` (installs Tuist version from config) - **Trust config**: `mise trust` (required once for security) - **Run Tuist**: `mise exec -- tuist ` or activate mise in your shell ## Sample App Workflow

No other project uses it yet

yuzutechCLAUDE.md

kroki

yuzutech/kroki/CLAUDE.md

dependency updates that are user-visible (diagram library versions, base Docker image versions) or security-relevant. - Run the linter (`npm run lint` in `mermaid/`, i.e. `biome check src`) whenever

No other project uses it yet

vijaythecoderCLAUDE.md

awesome-claude-agents

vijaythecoder/awesome-claude-agents/CLAUDE.md

clarification ### Tool Inheritance - Omitting `tools` field = inherit all tools (recommended) - Specify tools only for security restrictions - Includes WebFetch, MCP tools when available ## Development Guidelines 1. **Creating New Agents**: - Use templates/agent-template.md

eunomia-bpfCLAUDE.md

bpf-developer-tutorial

eunomia-bpf/bpf-developer-tutorial/CLAUDE.md

Advanced libbpf development - `src/19-21,29,41-42`: Networking (LSM, TC, XDP, sockops) - `src/22-28,34`: Security topics - `src/31,37`: Language integration (Go, Rust) - `src/44-45`: BPF schedulers - `src/47`: GPU tracing - Each tutorial

txn2CLAUDE.md

kubefwd

txn2/kubefwd/CLAUDE.md

injecting the OS call (see `runCommand` and `goos` in `pkg/fwdapi/network.go`), not left uncovered. - **Security**: `make security` runs gosec, govulncheck on both modules (gated by `scripts/govulncheck-gate.py` against `.govulncheck-allow.txt`), and osv-scanner

No other project uses it yet

langroidCLAUDE.md

langroid

langroid/langroid/CLAUDE.md

transforming and passing messages - **Collaboration**: Multiple agents can work together on complex tasks ### Key Security Features: - The `full_eval` flag in both `TableChatAgentConfig` and `VectorStoreConfig` controls code injection protection - Defaults

No other project uses it yet

patriksimekCLAUDE.md

vm2

patriksimek/vm2/CLAUDE.md

safely sandboxes untrusted JavaScript code running in Node.js. This is a security-critical project -- every change must be evaluated for sandbox escape potential. ## Public API Exported from `lib/main.js` via `index.js

sw33tLieCLAUDE.md

macshot

sw33tLie/macshot/CLAUDE.md

secret filter │ ├── LanguageManager.swift # Locale resolution + L("…") lookup │ ├── ScreenshotHistory.swift # Local history in ~/Library/Application Support/ │ └── SaveDirectoryAccess.swift # Security-scoped bookmark for save directory │ ├── Upload/ │ ├── UploadPayload.swift # Streamed upload bodies (chunking, incremental SHA256, multipart

No other project uses it yet

dora-rsPipes a download into a shellCLAUDE.md

dora

dora-rs/dora/CLAUDE.md

/review Run the `/review` skill on your changes before committing. This catches structural issues, security problems, and logic errors that tests and clippy miss. ### Step 2: Run /simplify

AnthropicCLAUDE.md

anthropic-sdk-python

anthropics/anthropic-sdk-python/CLAUDE.md

doesn't allow `None`. Drop the workaround. Where a wrong value would be a security problem, validate explicitly instead and reject anything unknown. - **Failing open on unknown values.** A permission

corazawafCLAUDE.md

coraza

corazawaf/coraza/CLAUDE.md

AGENTS.md](AGENTS.md). Read it before making changes; the testing, ADR, pull request and security sections are mandatory. @AGENTS.md

gadievronCLAUDE.md

raptor

gadievron/raptor/CLAUDE.md

training. --- ## COMMANDS /project - Project management — `libexec/raptor-project-manager [args]` (see PROJECTS) /scan /fuzz /web /codeql /analyze - Security testing — `python3 raptor.py ` /agentic - Scan → dedup → prep → analysis pipeline (exploitation-validator methodology) — `libexec/raptor-agentic --repo `. Optional