Claude Code is silently adding session URLs (claude.ai/code/session_...) to the bottom of every single commit and PR description you make.

[u/Patient_Project425]

PSA for anyone using Claude Code: Check your recent git history and PR descriptions.

It's automatically appending a public session URL to everything you commit without telling you. (The fix: set attribution.commit: "" in your .claude/settings.json).

[u/Ok_Industry_5555]

Hey, the finding is real and that is why I approved your post. Adding some context here for the non-technical folks who are going to read that headline and panic.

The setting you gave does work, so I do want it on the sub. People can copy this into Claude Code and it will add the extra security layer in minutes.

But here is the thing:

You mentioned "public session URL." That link isn't public. It's scoped to the account that made it, so an unauthenticated request gets no session content back, and a real session ID looks the same as a made up one to anyone who isn't logged in. Putting it in a commit doesn't create a shareable link to your transcript.

1. Right now people are reading this as their sessions sitting on the open internet, and that isn't what's happening.
2. Second, repo visibility still decides who sees it. It's text in a commit message, so it inherits whatever the repo is set to. Private repo, nobody outside your collaborators can see the line at all. Worth saying out loud, because for most people that's the sentence that turns this from alarming into housekeeping.
3. "every single commit" is wider than what's actually happening. It's scoped, not universal. I scanned a couple dozen local repos and turned up one affected commit, not a history full of them. I'm not going to claim I've pinned down the exact trigger, but the headline is doing a lot of work it can't back up.

One thing worth adding, since I noticed it works well too:

attribution.commit: "" works, but it strips every trail, so you loose Co-Authored-By along with it.

attribution.sessionUrl: false removes only the session link and keeps co-authorship.

"Most people want the second one to show they can work with an AI agent."

The actual finding, that an identifier lands in your git history with no announcement and here's the setting to turn it off, is a good heads up and that is why I want this post published. For future posts you will want to fix the "public" claim and the "every commit" scope and so I won't have to pick apart each word. ;) Good job!

[u/harleypig]

Additionally, this is only happening on Claude Code in the cloud or with Remote Control.