Z.ai's ZCode uploaded entire Git histories to Alibaba Cloud

Developer ferstar found that ZCode, the desktop coding app from Z.ai (Zhipu AI) built on GLM models, uploaded workspace snapshots to Alibaba Cloud object storage. In one 313 MB snapshot of 42,411 files, 86.6% of the payload was the .git directory including LFS objects and reflogs. Z.ai deleted the bucket on 20 September and open-sourced ZCode under Apache 2.0.

• A 313 MB snapshot held 42,411 files, 86.6% of it the .git directory
• Uploads were encrypted with a key wrapped to a server-held certificate, unreadable by users
• Z.ai deleted the Alibaba Cloud bucket on 20 September and open-sourced ZCode under Apache 2.0
• The upload endpoint and key delivery code are absent from version 3.14.0 onward