CLAUDE.md examples from real projects

fleetdmCLAUDE.md

fleet

fleetdm/fleet/.claude/CLAUDE.md

this repository. ## About Fleet Fleet is an open-source platform for IT and security teams: device management (MDM), vulnerability reporting, osquery fleet management, and security monitoring. Go backend, React/TypeScript frontend

No other project uses it yet

DimillianCLAUDE.md

IceCubesApp

Dimillian/IceCubesApp/CLAUDE.md

timeline, mentions, and accounts ### Important Implementation Details - **Multi-account**: Managed through `AppAccountsManager` with secure storage - **Push Notifications**: Custom proxy server implementation for privacy - **Theme System**: Extensive customization with

chillzhuangCLAUDE.md

SpringBlade

chillzhuang/SpringBlade/CLAUDE.md

Cloud Gateway（WebFlux） | | ORM | MyBatis-Plus + dynamic-datasource-spring-boot4-starter | | 安全 | blade-core-secure（JWT + 可选 AES 加密 + SM2 国密登录） | | 缓存 | BladeRedis（Protostuff 序列化，响应式 Gateway 侧用 Reactive Redis

mermaid-jsReads credentialsCLAUDE.md

mermaid-live-editor

mermaid-js/mermaid-live-editor/CLAUDE.md

Both edit either the diagram code or the mermaid config JSON depending on `editorMode`. ### Security States loaded from URLs pass through `sanitizeConfig` (state.svelte.ts), which detects unsafe mermaid config (XSS vectors

j3ssieReads credentialsCLAUDE.md

osmedeus

j3ssie/osmedeus/CLAUDE.md

TOKEN); DRY_RUN=1 to preview ``` ## Architecture Overview Osmedeus is a workflow engine for security automation. It executes YAML-defined workflows with support for multiple execution environments. ### Layered Architecture ``` CLI/API

Arthur-FicialCLAUDE.md

apfel

Arthur-Ficial/apfel/CLAUDE.md

Proper error types. Real token counts. - **Swift 6 strict concurrency.** No data races. - **Usable security.** Secure defaults that don't get in the way. - **TDD always, red-to-green

airweave-aiCLAUDE.md

airweave

airweave-ai/airweave/CLAUDE.md

path (just `host.com/{endpoint}`) - Use logger from `ctx` (API) or `sync_context` (during sync) - Security: never use `random.*` for security values (ruff S311); use `secrets` module ### Frontend (TypeScript) - TailwindCSS with

czlonkowskiCLAUDE.md

n8n-skills

czlonkowski/n8n-skills/CLAUDE.md

user first) - Secret-free/domain-free templates in `assets/`; fresh secrets generated on the box; secure defaults; DNS/ports preflight; Day-2 update/backup/restore - Python Code nodes need task runners in external mode

No other project uses it yet

op7418CLAUDE.md

CodePilot

op7418/CodePilot/CLAUDE.md

test.ts` - fail-closed：分类器出错 / 空暂存集 / 非 `docs` 判定一律走全量门禁（防「前置失败被静默放行」回归） 高风险 docs（release / security / runtime / provider / permission / DB schema）即便走 docs 快路，也应手动跑 `npm run test`（必要时 build / smoke

aptos-labsCLAUDE.md

aptos-core

aptos-labs/aptos-core/CLAUDE.md

definitions used everywhere - `aptos-vm` - VM integration and transaction execution - `aptos-crypto` - Cryptographic primitives (security-critical) - `aptos-api-types` - API request/response types ## Safety-Critical Code These directories require extra care

No other project uses it yet

cryticCLAUDE.md

slither

crytic/slither/CLAUDE.md

slither/ ├── analyses/ # Data dependency, dominators, control flow ├── core/ # Core classes: SlitherCore, Contract, Function ├── detectors/ # Security checks (subclass AbstractDetector) ├── printers/ # Output formatters (subclass AbstractPrinter) ├── slithir/ # Intermediate representation for analysis ├── solc_parsing

No other project uses it yet

Provenance-EmuReads credentialsCLAUDE.md

Provenance

Provenance-Emu/Provenance/CLAUDE.md

# CLAUDE.md This file provides guidance to Claude Code (claude.ai/code) when working with code

androguardCLAUDE.md

androguard

androguard/androguard/CLAUDE.md

large `workspace/output/` trees. - Do not invent APIs; read `androguard/application.py` and `androguard/cli/main.py` when unsure. - Authorized security analysis only; do not help with malware distribution or unauthorized access

FlorianBruniauxCLAUDE.md

claude-code-ultimate-guide

FlorianBruniaux/claude-code-ultimate-guide/CLAUDE.md

printable summary ├── cowork.md # Cowork redirect page ├── core/ # Architecture, methodologies, releases, known-issues, visual-reference ├── security/ # security-hardening, sandbox-isolation, sandbox-native, production-safety, data-privacy ├── ecosystem/ # ai-ecosystem, mcp-servers

No other project uses it yet

rundeckCLAUDE.md

rundeck

rundeck/rundeck/CLAUDE.md

Groovy auto-generates getters/setters — do NOT implement them explicitly unless custom logic is needed. ### Security Avoid command injection, XSS, SQL injection. Use parameterized queries and escape user input. ### Simplicity Only

No other project uses it yet

Q00CLAUDE.md

ouroboros

Q00/ouroboros/CLAUDE.md

introduced by this PR? 5. If scope is split, does immediate user-data or security risk remain? Use these decisions: - Q1 + Q2: **Changes Requested**. - Q3 + Q5: stop and revisit

No other project uses it yet

wiltodeltaCLAUDE.md

remove-ai-watermarks

wiltodelta/remove-ai-watermarks/CLAUDE.md

binding registry snapshot is stale; rerun it without `--check` to refresh the snapshot. Triaged security blocks and their recheck procedure, environment recovery, CI behavior, and fixture policy live in [`docs/development.md

No other project uses it yet

HeliconeCLAUDE.md

helicone

Helicone/helicone/CLAUDE.md

useJawnClient()` ### Database - PostgreSQL with snake_case naming - ClickHouse for analytics - Proper RLS policies for security ## Tech Stack ### Frontend - Next.js 14 with React 18.3.1 - TypeScript, Tailwind CSS, Radix UI - Zustand

No other project uses it yet

appleboyCLAUDE.md

ssh-action

appleboy/ssh-action/CLAUDE.md

Docker containers (tests `./` local action) - `.github/workflows/stable.yml` - Tests against published `appleboy/ssh-action@v1` tag - `.github/workflows/trivy-scan.yml` - Automated security scanning for vulnerabilities and misconfigurations ## Testing ### Running Tests Tests run automatically via GitHub Actions workflows

No other project uses it yet

eberttiCLAUDE.md

awesome-telegram

ebertti/awesome-telegram/CLAUDE.md

links) - The entry is a crypto trading bot that requests API keys via Telegram (security risk) - The content appears to be self-promotion of paid/adult/gated content groups - The PR title