That's the chain, yes. The part people don't expect: the file is created inside the project, and Claude Code only adds it to your global git ignore, not the repo's .gitignore. So a fresh clone or a second machine commits it like any other file. In 539 of the 1,105 repos we traced, a commit co-authored by Claude itself changed the file.

▲

Aurornis a day ago | parent | next [-]

> the file is created inside the project, and Claude Code only adds it to your global git ignore, not the repo's .gitignore. So a fresh clone or a second machine commits it like any other file

A fresh clone wouldn’t have the file. This claim doesn't make any sense.

The only way I can see this getting committed is if someone edited their global .gitignore or, more likely, did a whole directory transfer to do a different machine to work on.

▲

shmulc a day ago | parent [-]

Fair, “fresh clone” was wrong. It happens on a new machine or container without the global ignore, in a copied project folder, or once the file has been committed, since ignore rules don’t apply to tracked files.

▲

CrimsonRain 21 hours ago | parent | next [-]

Why are you copying instead of git clone?

▲

hathawsh 21 hours ago | parent [-]

The new wave of git users (coming from AI) don't know what git is.

	▲	yubblegum 17 hours ago \| parent [-]
		I wonder how many of this type are 'senior/principle software engineers' employed by our AI vendor overlords. This situation is the inevitable result of vocal VCs (ahem) poo pooing "age" and "experience" and promoting youth as a 'requirement' starting in the '00s, coupled with these same VCs now attempting to hijack an entire industry to run on their obviously immature and buggy and frankly possibly dangerous products. The silver lining in all this is all of us very experienced "ancient" software practitioners will likely be in demand again. In a sane world, of course.

▲

rendaw a day ago | parent | prev [-]

In that case what relevance does the gitignore file have at all?

▲

kccqzy a day ago | parent | prev | next [-]

That doesn’t make sense. I use my own global git ignore all the time because there are files that only I produce that I definitely don’t want committed (flycheck looking at you). A fresh clone wouldn’t contain these files because they are not committed in the first place. You will have to use a non-git transport mechanism to transfer the repo without also transferring your global git ignore.

Anyways this probably indicates that these repos don’t have a good code review process. The settings.local.json file name screams it’s local and shouldn’t be committed.

	▲	pastel8739 a day ago \| parent [-]
		They're probably mostly just random solo people who barely even know what git is. This---that people who don't know how to code can code now--is the whole thing that AI companies love to advertise, and it's true. But it also means that tools need to stop people from doing stupid things, because they won't know that the things they are doing are stupid.

▲

cassianoleal a day ago | parent | prev [-]

It's a disgrace that the parent comment was flagged. My vouching has undone that but it's likely to be flagged again.

▲

nightpool a day ago | parent | next [-]

It's fully AI generated. Please don't vouch for comments that don't have human input, it's against the rules:

> Don't post generated text or AI-edited text. HN is for conversation between humans.

Also, it's wrong. Many people have since replied pointing out the basic error it made

	▲	_cs2017_ 14 hours ago \| parent \| next [-]
		The author of this comment is also the one who submitted and authored the article being discussed. No matter whether it's AI generated (I can't tell) or correct (it's not), it makes no sense to flag the response by the author.
	▲	cassianoleal 17 hours ago \| parent \| prev [-]
		> It's fully AI generated How have you determined that? Furthermore, I have also noticed the error. I can still see it happening. Sandboxed agent, no access to global git ignore. Creates a new one after putting the secret in `.claude`. Same developer, same machine, fresh sandbox. No access to the original sandbox's global gitignore. Secret already on the project. Commit and push. Secret leaked.

▲

Aurornis a day ago | parent | prev | next [-]

All of their comments were auto flagged from the moment they were posted. Must have triggered an LLM detector or spam detector.

▲

kragen a day ago | parent | prev [-]

It's AI slop. If what it says is actually true, hopefully a human will post it.