Inside ZCode: Silently uploading your Git history to the cloud

If you use Zhipu’s ZCode desktop assistant, your entire Git history may be silently uploading to cloud storage.

Developer Ferstar investigated why their ~/.zcode folder ballooned past 700MB and uncovered the app's quiet background routine. Reverse-engineering the client showed that whenever a user is logged in, ZCode archives local workspace files—including commit histories, LFS caches, and app settings—encrypts the batch, and sends it directly to Aliyun OSS storage nodes.

Why it matters: Roughly 87% of the payload is raw .git data. Instead of reading active code to help you type, ZCode grabs your entire repository lineage, which can expose deleted API keys, unpushed branch names, and internal server paths. Worse, checking the codebase revealed that UI toggles meant to control telemetry do not actually stop these snapshot uploads.

Know this: The app encrypts the snapshot using an RSA public key sent dynamically from Zhipu's backend. Because the corresponding private key lives exclusively on the server, you cannot decrypt or inspect the archived files sitting on your own drive.

Check your background network traffic before trusting third-party coding assistants with proprietary repositories.