Claude Code has been writing session URLs into your commits

Claude Code has been appending a git trailer linking back to the coding session, Claude-Session, to commits and PR descriptions for web and Remote Control sessions. A setting called attribution.sessionUrl controls it, and defaults to true. A 270-upvote PSA on r/ClaudeAI laid out the mechanics: run git log --format=%B -20 | grep Claude-Session in a repo you've been agenting on, and if you get hits, you've been publishing a trailer you never agreed to.

attribution.sessionUrl is a different key from attribution.commit, the one everyone already disabled after the co-author trailer debate. I turned that one off months ago and assumed I'd handled it. I hadn't. Four issues on anthropics/claude-code track this: 41873, 66504, 69614, and 76899. The last two ask for opt-in behavior and note the docs never listed the flag at all.

The thread's own read is that the URL doesn't resolve for anyone but you, so it's not credential leakage. I buy that, and I still think it's worse in a different way. A leak you can rotate. Git history you can't. A squash-merged PR in a public repo carries that dead link forever, baked into a commit hash. Rewriting it means rewriting history on a shared branch, which nobody does for cosmetics.

The fix is two lines in ~/.claude/settings.json or your project's .claude/settings.json: set both attribution.sessionUrl and attribution.commit to false. Put it in your dotfiles so it survives a machine move, and add it to any team template before another commit goes out. Per-developer settings mean one person who never saw this thread keeps writing the trailer into shared branches.

Anthropic confirmed a separate change the same week. Starting September 14, weekly limits on Pro, Max, Team and seat-based Enterprise move to 125% of the original baseline as the temporary 50% boost from May expires, which BleepingComputer reported as a net 17% cut from current usage. One change writes to your repo, one shrinks your budget. Only the second one got a blog post.