← Back to articles

Inside ZCode: Silently uploading your Git history to the cloud

2026-09-18 | original

read original get YubiKey 5C NFC Security Key → more articles

Why This Matters

This investigation reveals that Zhipu's ZCode AI coding app silently compresses, encrypts, and uploads users' entire local Git workspaces—including commit history and project files—to Aliyun cloud storage without clear consent, using encryption keys the user can't access. This raises serious concerns about data privacy, intellectual property exposure, and the trustworthiness of AI coding tools that operate with deep filesystem access, especially for developers working on proprietary or commercial codebases.

Key Takeaways

ZCode was found silently packaging and uploading entire project directories—including .git history and configs—to Aliyun OSS while users were simply logged in.
The encryption scheme used means only Zhipu's servers hold the private key, so even the user or the app itself cannot decrypt the uploaded data stored locally.
The case underscores a broader trust and transparency problem with AI coding assistants that have deep access to local codebases, especially for commercial or sensitive projects.

Worth a Look

YubiKey 5C NFC Security Key — If you're auditing how AI coding tools handle your credentials and repo data, it's a good time to lock down account access with hardware-based 2FA. A YubiKey adds a strong physical authentication layer so stolen tokens or leaked keys alone can't compromise your accounts. It's a simple, durable way to harden your dev environment against exactly the kind of silent data exfiltration this article describes.

See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.

I am not a native English speaker; this article was translated by AI.

It started with a routine check while freeing up disk space: ~/.zcode was taking up over 700MB. After digging into it intermittently, I confirmed something pretty wild:

Whenever you are logged in, ZCode (Zhipu’s official AI coding desktop app) silently packages your entire workspace — complete .git history, LFS asset cache, reflogs, and global app configs — encrypts it, and uploads it directly to Aliyun OSS.

Even more ironic: the RSA public key used for encryption is delivered on the fly by the server, while the private key lives exclusively in the cloud. You cannot decrypt that multi-hundred-megabyte ciphertext sitting right on your own disk, and neither can the ZCode client itself.

Here is the complete record of the investigation, the evidence chain, and a one-liner defense that permanently shuts it down.

The Starting Point: A 313MB Archive Stuck in Pending #

~/.zcode is the data root of ZCode. The size breakdown looked roughly like this:

cli/ : ~257MB (session databases, execution logs)

: ~257MB (session databases, execution logs) computer-use/ : ~130MB (bundled app and runtime dependencies)

: ~130MB (bundled app and runtime dependencies) v2/checkpoints/ : ~303MB (the main suspect)

... continue reading

Explore topics: zcode aliyun oss git history rsa encryption zhipu ai