According to Beating AI News, ZCode, an AI programming tool, is reportedly taking a snapshot of the entire project in the background, packaging and encrypting it along with the .git file, and then uploading it to Alibaba Cloud OSS.
Tech blogger ferstar, after reverse engineering the client, stated that this mechanism would run as long as the user was logged in, and there was no switch in the interface to disable uploading.
The author found a snapshot of a commercial project that was approximately 313MB, containing 42,000 files. The `.git` folder comprised 86.6% of this, including Git history objects, LFS large file cache, and reflog. This means that the packaged file included not only the current code but also older commits, previously downloaded large files, and local branch operations. This snapshot had failed to upload 564 times and remained local awaiting retry.
ZCode's official privacy policy currently only explicitly states that it collects text, files, and code submitted by users "in conversations," without explicitly mentioning the entire repository and Git history. The official "Optimization Program" is off by default, but it only controls whether data is used for model training; Ferstar states that turning off this option will not stop snapshot packaging and uploading.