Claude.Md Boilerplate

Claude Code Standards Template

Drop-in engineering standards for Claude Code. Copy two things into your project — a `CLAUDE.md` file and a `docs/standards/` folder — and Claude Code starts enforcing security, testing, tenant isolation, structured logging, and observability by default.

Quick Start

# Copy into your project
cp CLAUDE.md /path/to/your/project/
cp -r docs/standards/ /path/to/your/project/docs/standards/

# Tailor it (run this prompt in Claude Code):
# "Review CLAUDE.md and docs/standards/. Remove anything irrelevant
#  to [describe your project]. Update anything outdated."

# Start building. Standards are enforced automatically.

FAQ

**What does this actually do?** It gives Claude Code a persistent instruction set that prevents the most common production failures: hardcoded secrets, missing tenant isolation, swallowed exceptions, skipped tests, unstructured logging, and unscoped data access. It doesn't just tell Claude what to build — it tells Claude what not to skip.

**How big is the context overhead?** The root `CLAUDE.md` is ~75 lines. That's always loaded. The 12 detailed pillar files in `docs/standards/` are only loaded on demand when Claude works in a relevant domain (e.g., `database.md` loads when you're writing migrations). Most conversations only load 1-2 pillar files.

**Do I need all of it?** No. A CLI tool doesn't need tenant isolation. A static site doesn't need correlation IDs. Run the tailoring prompt in Quick Start to strip what doesn't apply. The template is deliberately opinionated — fork it and cut what you don't need.

**Does it guarantee compliance?** No. It provides technical controls that compliance frameworks like GDPR, PCI-DSS, and APRA CPS 234 require, but compliance is an organisational and legal exercise. This is a guardrail, not a certification.

**Does Claude always follow the rules?** No. Claude follows instructions probabilistically. These rules significantly improve the baseline, but in long sessi