CLAUDE.md

1# Bitwarden Server - Claude Code Configuration
2 
3## Project Context Files
4 
5**Read these files before reviewing to ensure that you fully understand the project and contributing guidelines**
6 
71. @README.md
82. @CONTRIBUTING.md
93. @.github/PULL_REQUEST_TEMPLATE.md
10 
11## Critical Rules
12 
13- **NEVER** use code regions: If complexity suggests regions, refactor for better readability
14- **NEVER** compromise zero-knowledge principles: User vault data must remain encrypted and inaccessible to Bitwarden
15- **NEVER** log or expose sensitive data: No PII, passwords, keys, or vault data in logs or error messages
16- **ALWAYS** use secure communication channels: Enforce confidentiality, integrity, and authenticity
17- **ALWAYS** encrypt sensitive data: All vault data must be encrypted at rest, in transit, and in use
18- **ALWAYS** prioritize cryptographic integrity and data protection
19- **ALWAYS** add unit tests (with mocking) for any new feature development
20 
21## Project Structure
22 
23- **Source Code**: `/src/` - Services and core infrastructure
24- **Tests**: `/test/` - Test logic aligning with the source structure, albeit with a `.Test` suffix
25- **Utilities**: `/util/` - Migration tools, seeders, and setup scripts
26- **Dev Tools**: `/dev/` - Local development helpers
27- **Configuration**: `appsettings.{Environment}.json`, `/dev/secrets.json` for local development
28 
29## Security Requirements
30 
31- **Compliance**: SOC 2 Type II, SOC 3, HIPAA, ISO 27001, GDPR, CCPA
32- **Principles**: Zero-knowledge, end-to-end encryption, secure defaults
33- **Validation**: Input sanitization, parameterized queries, rate limiting
34- **Logging**: Structured logs, no PII/sensitive data in logs
35 
36## Common Commands
37 
38- **Build**: `dotnet build`
39- **Test**: `dotnet test`
40- **Run locally**: `dotnet run --project src/Api`
41- **Database update**: `pwsh dev/migrate.ps1`
42- **Generate OpenAPI**: `pwsh dev/generate_openapi_files.ps1`
43 
44## Development Workflow
45 
46- Security impact assessed
47- xUnit tests added / updated
48- Performance impact considered
49- Error handling implemented
50- Breaking changes documented
51- CI passes: build, test, lint
52- Feature flags considered for new features
53- CODEOWNERS file respected
54 
55### Key Architectural Decisions
56 
57- Use .NET nullable reference types (ADR 0024)
58- TryAdd dependency injection pattern (ADR 0026)
59- Authorization patterns (ADR 0022)
60- OpenTelemetry for observability (ADR 0020)
61- Log to standard output (ADR 0021)
62 
63## References
64 
65- [Server architecture](https://contributing.bitwarden.com/architecture/server/)
66- [Architectural Decision Records (ADRs)](https://contributing.bitwarden.com/architecture/adr/)
67- [Contributing guidelines](https://contributing.bitwarden.com/contributing/)
68- [Setup guide](https://contributing.bitwarden.com/getting-started/server/guide/)
69- [Code style](https://contributing.bitwarden.com/contributing/code-style/)
70- [Bitwarden security whitepaper](https://bitwarden.com/help/bitwarden-security-white-paper/)
71- [Bitwarden security definitions](https://contributing.bitwarden.com/architecture/security/definitions)
72