Person
Developer who publishes reverse-engineering analyses of desktop applications under this handle.
Z.ai's ZCode app uploaded workspace snapshots to Alibaba Cloud, and 86.6 percent of one 313 MB example was .git data, a teardown found. Z.ai deleted the bucket on 20 September, and nobody can audit what happened to anything uploaded before 18 September, the write-up says.
Reality
The researcher ferstar found the archive sitting in ~/.zcode, 86.6 percent of it .git history, after 564 failed attempts to push it straight to an Aliyun OSS bucket, and Zhipu confirmed the upload behavior the day the writeup went out.
Perspective Coverage
3 publishersReality
Z.ai has disabled the feature, deleted the cloud data and commissioned two outside assessments. For teams buying coding assistants, the test this leaves behind is measuring what the process sends before approving it.
Reality
Two outside bodies reported ZCode's cloud storage bucket empty, and the researcher who found the problem confirms the upload pipeline is gone. The repository Z.ai published holds two commits and not the code that did the uploading.
Reality
A developer found a 313MB archive of his commercial project queued for upload and could not open it, because the private key sits on Z.ai's back end. Z.ai says the data is destroyed once the page is built.
Reality
A reverse-engineering walkthrough published September 18th traced a 313MB archive in ZCode's local data directory to a 42,411-file commercial workspace whose Git objects and LFS blobs were 86.6% of the payload.
Reality