Z.ai's ZCode Silently Uploads Full Git History
Reverse engineering found that Z.ai's desktop coding app ZCode, while logged in, encrypts and uploads the entire workspace including Git history to Aliyun OSS. The private key needed to decrypt the archive exists only on Z.ai's cloud, not on the user's disk.
Developers handling proprietary or private repositories should verify how third-party coding agents transmit and manage encryption keys before adopting them.