ZCode AI coding app silently encrypts and uploads users' full Git history to Aliyun OSS

ZCode, the AI coding desktop app attributed to Zhipu (branded Z.ai) in the two reports, packages the entire workspace — including complete .git history — into an AES-256-CTR-encrypted archive uploaded to Aliyun OSS, and settings toggles do not stop it.

Two write-ups published 2026-09-18 describe how ZCode silently uploads users' workspaces while the app is logged in. Researcher ferstar (described as 'a blogger' in the earlier report) reverse-engineered app.asar and found the client requests credentials from zcode.z.ai, encrypts archives with AES-256-CTR, wraps the key with a server-delivered RSA-OAEP public key, and posts directly to Aliyun OSS — meaning only Zhipu's backend holds the private key and users cannot decrypt their own uploads. In one case, a 345MB, 42,411-file commercial project produced a 313MB encrypted baseline snapshot, with .git data making up 86.6% of the payload and exposing deleted secrets, unpushed branch names, and internal hostnames; the ~/.zcode directory also recorded 564 failed upload attempts. The archives include .git history, LFS caches, reflogs, and global configs. Reports disagree slightly on the toggles: one says UI settings disable only training-data authorization, while the other says they control training authorization and server-side indexing — both agree that snapshot capture and upload continue regardless, which the later report attributes to a host-level capture sidecar running unconditionally before every prompt. The disclosure drew over 276,000 views.

• ZCode packages .git history, LFS caches, reflogs, and global configs into encrypted workspace archives uploaded when the app is logged in
• A 345MB, 42,411-file commercial project produced a 313MB encrypted baseline snapshot; .git data accounted for 86.6% of the payload
• Archives are encrypted with AES-256-CTR; the key is wrapped with a server-delivered RSA-OAEP public key, so only Zhipu's backend can decrypt uploaded archives
• Users cannot decrypt their own uploaded archives because the private key never leaves the server
• Upload flow: credential request to zcode.z.ai, then a direct form POST to Aliyun OSS storage
• The ~/.zcode directory recorded 564 failed upload attempts
• Exposed data includes deleted secrets, unpushed branch names, and internal hostnames
• UI toggles reportedly control only training-data authorization (per one report, plus server-side indexing); snapshot capture and upload continue regardless