Claude Rules
Browse reusable Claude rules, project guardrails, operating constraints, and prompt policies for teams standardizing AI-assisted development.
- Read the rule for scope and caveats.
- Copy the full rule into CLAUDE.md or your rule system.
- Run a normal workflow and adjust language that is too broad.
Highlights from this set
Standout Claude Rules, picked from their own metadata — trust tier, provenance, documentation, and recency.
Top Rules
AI-Generated IDOR (Broken Object-Level Authorization) Review Rules
Review AI-generated endpoints for IDOR: object-level authorization on every request, scoped lookups instead of raw ID fetches, and consistent checks across CRUD and admin operations.
AI-Generated Insecure Deserialization Review Rules
Review AI-generated deserialization code: avoid native formats like pickle/yaml.load/Java Serializable on untrusted input, prefer JSON, and allowlist types or verify integrity when native formats are unavoidable.
AI-Generated Mass Assignment Review Rules
Review AI-generated request-to-model binding code for mass assignment: allowlist bindable fields, use DTOs that exclude sensitive properties, and don't trust a framework's default autobinding.
AI-Generated Open Redirect Review Rules
Review AI-generated redirects for open redirect risk: allowlist destinations, avoid raw user-supplied URLs, and prefer relative paths or an indexed mapping over echoing the input back.
AI-Generated OS Command Injection Review Rules
Review AI-generated shell/subprocess code for command injection: prefer library calls over shelling out, array-form exec APIs, allowlist validation, and least privilege.
AI-Generated Prototype Pollution Review Rules
Review AI-generated JS/TS merge, clone, and object-assignment code for prototype pollution: block proto and constructor-prototype keys, prefer Map/Set or Object.create(null) over mutable object literals.
AI-Generated XSS (Cross-Site Scripting) Review Rules
Review AI-generated code for XSS: context-correct output encoding, unsafe DOM sinks like innerHTML, HTML sanitization, and CSP as a secondary layer.
AI-Generated CSRF Protection Review Rules
Review AI-generated endpoints and forms for CSRF: safe methods, anti-CSRF tokens, SameSite cookies, origin checks, and cookie-session exposure.
AI-Generated Path Traversal Review Rules
Review AI-generated file-handling code for path traversal: canonical paths, root confinement, upload filename sanitization, and archive extraction limits.
AI-Generated Regex Safety Review Rules
Review AI-generated regex for ReDoS and catastrophic backtracking, input bounds, anchors, escaping, validation scope, safe engines, and test evidence.
AI-Generated SQL Injection Review Rules
Review AI-generated database code for SQL injection: parameterized queries, safe identifiers, ORM escapes, dynamic SQL limits, and least-privilege access.
AI-Generated SSRF Review Rules
Review AI-generated server-side URL requests for SSRF: URL allow-lists, internal-network blocking, redirect limits, and response isolation.
Event Sourcing Implementation Review Rules
Review event-sourcing code for immutable events, schema evolution safety, idempotent handlers, snapshot correctness, and event-store consistency.
Feature Flag Lifecycle Review Rules
Review feature flag changes for safe defaults, kill switches, targeting, staged rollout, stale-flag cleanup, and privacy-safe configuration.
Structured Logging Review Rules
Review logging changes for structured events, consistent levels, correlation IDs, actionable messages, volume control, and no secrets or personal data.
Test Double Misuse Review Rules
Review test doubles for over-mocking, under-mocking, mock drift, and missing contract tests for faked dependencies to keep tests meaningful and reliable.
Third-Party API Resilience Review Rules
Review remote API calls for timeouts, bounded retries with backoff and jitter, idempotency, circuit breakers, rate-limit handling, and safe failure logging.
Kotlin Expert - CLAUDE.md Rules for Claude Code
Transform Claude into a Kotlin specialist covering coroutines, null safety, data classes, sealed hierarchies, and idiomatic API design.
Laravel Expert - CLAUDE.md Rules for Claude Code
Transform Claude into a Laravel specialist covering routing, Eloquent, validation, authorization, queues, and deployment.
Django Expert - CLAUDE.md Rules for Claude Code
Transform Claude into a Django specialist covering ORM, class-based views, DRF, auth, migrations, and deployment.
MCP Remote Authorization Boundary Rules
Review remote MCP authorization boundaries before approving OAuth-backed servers.
AI Assistant Secret Handling Rules
Keep AI coding assistants from leaking secrets by using redaction, approved secret stores, pre-commit checks, rotation triggers, and privacy-safe notes.
Top Rules, compared
The leading rules side by side on the signals that matter before you install — trust tier, source provenance, install risk, setup, and disclosed safety notes. Ordered by HeyClaude's metadata review, not by repo popularity.
Signal coverage
How these 90 resources score on the trust and safety signals HeyClaude reviews — counted from this set, not the directory as a whole.
Frequently asked
- What are Claude Rules?
- Prompt guardrails, project rules, and operating constraints.
- How do I use Rules from HeyClaude?
- Copy the full rule asset into CLAUDE.md or your project rule system instead of only taking the summary.
- Are HeyClaude Rules reviewed before they are listed?
- Each entry is metadata-reviewed for source, trust, and safety/privacy signals before it appears. HeyClaude does not scan for malware, so always review the linked source before installing anything that touches your filesystem, network, or credentials.
A short, calm digest of reviewed Claude resources. Unsubscribe any time.