How real projects brief Claude Code: the commands, conventions and warnings they put in CLAUDE.md.
affaan-mCLAUDE.mdaffaan-m/ECC/CLAUDE.md
/e2e, etc.) - **hooks/** - Trigger-based automations (session persistence, pre/post-tool hooks) - **rules/** - Always-follow guidelines (security, coding style, testing requirements) - **mcp-configs/** - MCP server configurations for external integrations - **scripts/** - Cross-platform
affaan-mCLAUDE.mdaffaan-m/ECC/examples/CLAUDE.md
Unit tests for utilities - Integration tests for APIs - E2E tests for critical flows ### 4. Security - No hardcoded secrets - Environment variables for sensitive data - Validate all user inputs - Parameterized queries only
n8n-ioCLAUDE.mdn8n-io/n8n/.github/CLAUDE.md
visual) | | `ci-` | Continuous integration | | `util-` | Utilities (notifications) | | `build-` | Build processes | | `release-` | Release automation | | `sec-` | Security scanning | Reusable workflows: add `-reusable` or `-callable` suffix. ### Common Tasks **Add workflow:** Create in `workflows
Significant-GravitasCLAUDE.mdSignificant-Gravitas/AutoGPT/classic/CLAUDE.md
agents (saves to `autogpt.yaml`) | | **Deny** | Deny this command (saves to appropriate deny list) | ### Default Security Out of the box, the following are **denied by default**: - Reading sensitive files
garrytanCLAUDE.mdgarrytan/gstack/CLAUDE.md
listener rules, Unicode sanitization at egress, SSE/CDP helpers, setup symlink hardening, and the sidebar security stack all live there, each pinned by a CI tripwire. **Egress receipts at every
browser-useCLAUDE.mdbrowser-use/browser-use/CLAUDE.md
file management - **PopupsWatchdog**: Manages JavaScript dialogs and popups - **SecurityWatchdog**: Enforces domain restrictions and security policies - **DOMWatchdog**: Processes DOM snapshots, screenshots, and element highlighting - **AboutBlankWatchdog**: Handles empty page redirects ### CDP Integration
JuliusBrusseeCLAUDE.mdJuliusBrussee/caveman/CLAUDE.md
until changed or session ends. ### Auto-clarity rule Caveman drops to normal prose for: security warnings, irreversible action confirmations, multi-step sequences where fragment ambiguity risks misread, user confused
A file Claude Code reads at the start of every session. It holds the commands, conventions and warnings the agent needs for this project.
At the repository root. Claude Code also reads CLAUDE.md files in subdirectories when it works there.
Build and test commands, the project's layout, conventions that aren't obvious from the code, and mistakes to avoid. Short files tend to work better than long ones.
Claude Code reads CLAUDE.md; most other agents read AGENTS.md. Many projects keep one and point the other at it.
