An investigation says ZCode uploads full workspace snapshots without disclosure
A reverse-engineering investigation says ZCode, Zhipu’s AI coding desktop app, packages logged-in users’ workspaces and uploads encrypted snapshots to Aliyun OSS, exposing a potential privacy risk for source code and Git history. The author found a 313MB encrypted archive built from a 345MB project snapshot, plus 564 failed upload attempts. ZCode requests upload credentials and a public key, encrypts the archive locally, then posts it directly to cloud storage.