Correction, October 13, 2026: Local user settings do not reach browser-based cloud sessions. Most settings changes reload during a running session. The issue reporter alleges a regression; its bug label does not independently establish that cause.

What happened

When Claude Code commits code or opens a pull request for you, it adds short metadata lines to the bottom of the message, called trailers. One says who worked on the change: Co-Authored-By: Claude. If you’re using Claude Code through the web at claude.ai, or through Remote Control (which lets you steer a coding session from your phone or another device), it can add a second, separate trailer: Claude-Session: https://claude.ai/code/session_<id>, a link back to the exact conversation that produced the commit.

A builder posting on Hacker News described disabling the “co-authored by” signature in their config, only to find Claude Code still appending the session-link trailer by default. Separate settings govern the signature and the session URL.

Claude Code’s current settings reference lists them separately, under an attribution object you can set in any settings file: attribution.commit changes or hides the “Co-Authored-By” line, attribution.pr does the same for pull request descriptions, and attribution.sessionUrl is the one that omits the session link from commits made through claude.ai or Remote Control. The older includeCoAuthoredBy setting some people still have in their config is deprecated and doesn’t cover the session link at all.

A GitHub issue filed against Anthropic’s own repository reports unexpected links after a user disabled the older attribution setting. That reporter had already disabled the older includeCoAuthoredBy setting, and still found the session-link trailer in roughly 318 commits across six private repositories over a two-week window. The reporter described it as a regression while using Claude Code version 2.1.258. The issue is labeled bug and has repro, indicating detailed reproduction steps rather than an independent confirmation of the cause. The report remains open.

Why this matters for you

A commit trailer isn’t a draft. Once you push it, it’s part of your repository’s permanent history. The only way to remove it afterward is to rewrite that history, which changes the edited commit’s ID and those of its descendants. Anyone who has already pulled that branch may need to reconcile the rewritten history. That’s disruptive enough that most teams won’t do it just to erase a stray link.

The trailer records a session identifier in shared history. Its presence does not by itself establish who can read the conversation. On a public repository, anyone browsing the code sees it. On a private one, every pull request reviewer sees it. If your team has a policy against broadcasting which commits were AI-generated, or simply doesn’t want internal session identifiers sitting in shared history, that’s precisely the detail a setting like this exists to suppress, and precisely what’s slipping through.

Claude Code’s MCP credential storage raises a separate question about where delegated service credentials are stored.

What builders should do next

First, check whether you’re already affected. Run this in any repository where you’ve used Claude Code through claude.ai or Remote Control:

git log --all --grep="Claude-Session"

This searches commit messages reachable from your local Git references. No output means no matching message in that local history; it does not check un-fetched remote branches or pull request descriptions. If it returns commits, they’re already in your history, and removing them means rewriting that history, so weigh that disruption against just leaving them.

To control future session links, merge this setting into an existing configuration file. For local and Remote Control sessions, user settings at ~/.claude/settings.json apply across projects on that machine:

{
  "attribution": {
    "sessionUrl": false
  }
}

If your settings still reference the older includeCoAuthoredBy key, add the attribution block instead. It’s the setting that’s actually documented to control the session link, rather than the older name that only ever controlled the “Co-Authored-By” line. Anthropic’s settings guide says most file edits reload in a running session. Browser-based cloud sessions do not read your local user settings. In a single-repository cloud session, commit .claude/settings.json so the setting reaches its clone; hosted multi-repository sessions read only selected plugin keys from those files.

Before pushing, inspect the generated commit message and pull request description. A configured opt-out is worth checking against the actual output, especially given the reported regression.

This only applies if you use Claude Code’s web interface or Remote Control. If you only run Claude Code locally from your terminal, this particular trailer was never part of your commits.

End of article