Claude Code puts a session link in commits unless you opt out

Claude Code adds a link to its own chat session to the commits it writes. The link lands in the commit message and in the pull request description. It is switched on by default. Developers argued about that default again on Hacker News on August 30, 2026.

Claude Code is Anthropic's command-line coding agent. It edits files, runs commands, and makes git commits for a developer. When it commits, it appends a git trailer. A trailer is a labeled line at the end of a commit message, like Signed-off-by:. This one reads Claude-Session: and carries a URL.

What the session link actually contains

The URL points at the conversation that produced the commit. The developer blog outofcontext.dev documented the format on June 30, 2026. It looks like https://claude.ai/code/session_01SBzqph11q7ZSHA5QEGgtu5.

That post also makes a finding worth repeating, because it cuts against the panic. The links are not public. outofcontext.dev describes a session URL as "generally only resolvable by the account that owns the session." Someone who finds one in a public repository cannot read the chat behind it. The post documented no case of a session URL exposing a private conversation.

The behavior does not apply to every session either. The Hacker News discussion says it is limited to Claude Code's web and Remote Control modes.

Why developers want it opt-in

The objection is about consent rather than leaked secrets. GitHub issue #66504 was filed on June 9, 2026 and asks for the feature to be opt-in. It notes there is no prompt, no warning, and no mention of the trailer during onboarding. Maintainers tagged it "enhancement" and "user-experience."

Opinion in the Hacker News thread split. One developer called the link "a lifesaver when you are trying to debug an old commit to pull up the chat session that actually wrote it." Others compared the trailer to a "Sent from iPhone" email signature. They read it as marketing rather than genuine attribution.

The practical worry is a work account. A session tied to a private repository can produce a commit that is later pushed somewhere public. The link still resolves only for its owner. But the commit now records that an agent wrote the change, and which session did it.

The settings that control it

The switches live in .claude/settings.json, the per-project configuration file Claude Code reads.

Setting	What it does
attribution.sessionUrl	Set to false to drop the Claude-Session: line. It defaults to true.
attribution.commit	Set to "" to strip attribution from commit messages.
attribution.pr	Set to "" to strip attribution from pull request descriptions.

According to outofcontext.dev, the single switch attribution.sessionUrl arrived in version 2.1.183. The same post dates the trailer itself to version 2.1.179.

What this means for developers

Check before you worry. Run git log --grep="Claude-Session:" in any repository an agent has touched. That lists every commit carrying the trailer, and in most repositories the answer will be none.

Decide this once for the team, not once per developer. Put attribution.sessionUrl in the repository's checked-in .claude/settings.json. A setting in someone's personal config protects one machine. A setting in the repository protects the project, including the contributor who installs Claude Code next week and never reads its release notes.

Do not rewrite published history over this. Force-pushing a rewritten branch breaks every clone and every open pull request. The links resolve only for their owner, so the cost of the cleanup is far higher than the exposure.

The wider pattern is worth watching. Coding agents increasingly write into artifacts that humans own and publish, including commit messages, changelogs, and release notes. Every tool that does this will face the same question that issue #66504 asks. The default should be the quiet one, and turning attribution on should be the deliberate choice.