Yeah, the HN post title is a bit misleading but the article is quite clear on that (although I'm sure many will be happy to gloss over this detail)

> Ask Claude Code to check a database or call an API, and the command it proposes carries the secret from your config file. It asks before running it. Pick "Yes, and don't ask again" and it saves that exact command, secret included, to .claude/settings.local.json inside the project folder. Nothing in the repo marks that file as private, so it gets committed with the rest of the code.

Why are these repos not gitignoring the .claude folder?

Although, I feel that it would make more sense to not have a .claude folder inside of the project to begin with. Instead use the ~/.claude/porject/<project_path> folder, like you do for the memory files to store anything related to the project. This solves the problem and at the same time is a cleaner architectural choice in my opinion.