ZCode Exposed for Uploading Project Snapshots and Git History in the Background

The AI programming tool ZCode has been exposed for automatically uploading entire project snapshots, including the .git folder, to Alibaba Cloud OSS in the background. Technical blogger ferstar conducted a reverse analysis and found that as long as the user is logged in, the upload mechanism will run, and there is no option to disable the upload in the interface. One commercial project snapshot found by the author is approximately 313MB, containing 42,000 files, of which .git files account for 86.6%, including Git history objects, LFS large file caches, and reflogs. This means that not only the current code but also old commits, previously downloaded large files, and local branch operations may also be packaged and uploaded. The snapshot failed to upload 564 times and is still waiting for a retry locally. ZCode's official privacy policy only mentions collecting text, files, and code submitted by users in conversations and does not explicitly state that the entire repository and Git history will be uploaded. The official "optimization plan" is set to off by default, only controlling whether data is used for model training. Ferstar pointed out that even if this option is turned off, the snapshot packaging and uploading will continue.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.