Session link is written into git history by default with no reliable opt-out

Summary

Claude Code appends a Claude-Session: trailer containing a https://claude.ai/code/session_<id> URL to git commit messages and pull request descriptions by default. This behaviour was never requested, is not surfaced at setup, and has no documented opt-out. It writes a vendor-controlled external URL into permanent customer source-control history.

For organisations with source-control governance, audit, or data-residency obligations, this is a material problem rather than a cosmetic one.

Impact

1. The artefact is effectively unrevocable.
A commit message cannot be edited after merge without rewriting shared history. On a protected branch consumed by other clones, CI, release automation and deployment tooling, history rewriting is not a proportionate remedy for a trailer nobody asked for. The exposure is therefore permanent by default.

2. It places a third-party identifier inside the customer's audit trail.
Commit metadata is frequently in scope for SOC 2, ISO 27001 and internal change-management evidence. Introducing an opaque external session reference into that record creates questions we then have to answer to auditors: what the URL resolves to, who can access it, how long it is retained, and under which agreement. None of that was a decision the organisation made.

3. It leaks tooling provenance.
The trailer discloses, per commit, that a given change was produced with a specific vendor's tool and links to a session identifier. Whether or not an organisation chooses to disclose AI assistance in its VCS history should be that organisation's decision, made deliberately — not a default applied silently.

4. The existing setting does not cover it.
includeCoAuthoredBy: false suppresses the Co-Authored-By: Claude trailer but does not suppress the Claude-Session: trailer. A user who has explicitly opted out of AI attribution in commits reasonably expects that to be the end of it. It is not, and the gap is not documented.

5. It is applied by subagents too.
Where work is delegated, the trailer propagates into every resulting commit without a further prompt, so the volume accumulates faster than a user is likely to notice.

Observed

In one working session across two internal repositories, 18 commits reached protected branches carrying the trailer before it was noticed. includeCoAuthoredBy was already set to false throughout. No settings.json key exists that would have prevented it; the only effective control we found was an explicit override written into CLAUDE.md instructing the model to disregard its own harness instruction.

Requiring a customer to countermand the product's system prompt in order to keep a vendor URL out of their git history is not a reasonable control surface.

Requested changes

1. Default this behaviour to off. Writing to a customer's version-control history should be opt-in, not opt-out.
2. Provide a documented settings.json key — for example includeSessionLink: false — that reliably suppresses the trailer in commit messages, PR titles and bodies, and issue comments, and that is honoured by subagents.
3. Have includeCoAuthoredBy: false imply it, or document explicitly that it does not, and why.
4. Document the behaviour where enterprise administrators will see it, including what the URL resolves to, who can access it, and the retention period.
5. Support enterprise-wide enforcement via managed settings, so an organisation can disable it centrally rather than relying on each engineer to discover and countermand it.

Rationale

The underlying goal — traceability from a commit back to the work that produced it — is legitimate. The implementation is the issue: it uses a vendor-hosted identifier in a permanent customer-owned record, by default, with no reliable off switch.

Where traceability is wanted, existing repository-native mechanisms already serve it: an issue or ticket key, a pull request number, a commit SHA. Those stay inside the customer's own systems and are already covered by their retention and access policy.

Environment

• Claude Code CLI, macOS
• includeCoAuthoredBy: false set in ~/.claude/settings.json
• Trailer emitted regardless, in both commit messages and PR descriptions