How to use CLAUDE.md with private repositories

Most tutorials assume a public repo. With a private repository, using CLAUDE.md safely takes a few extra steps so you give Claude context without leaking secrets or internal architecture.

1. Grant the right access

Claude Code authenticates with a GitHub token. For a private repo, use a token (or GitHub App installation) scoped to that repository — prefer fine-grained tokens over classic ones, and set an expiry.

2. Keep secrets out of CLAUDE.md

Never paste API keys, .env contents, or internal endpoints into the context file. Describe where secrets live and how to load them, not their values:

# Config
- Load secrets from .env (never committed)
- Auth via GITHUB_TOKEN, injected at runtime

3. Don't commit it if the repo is shared externally

If contractors or a public mirror touch the repo, keep CLAUDE.md out of the default branch. You can still generate it locally and drop it in ~/.claude/ project memory instead.

4. Regenerate after refactors

Private codebases change fast. A stale context file is worse than none. Generate a fresh CLAUDE.md from your private repo and re-drop it whenever the structure shifts.