Inside ZCode: Silently Uploading Your Entire Git History to the Cloud
Reverse engineering of Zhipu’s ZCode desktop app reports that, while logged in, it packages a workspace—including .git history, LFS data, reflogs, and configs—encrypts the archive, and uploads it to Aliyun OSS. The reconstructed flow says the server supplies an RSA public key and keeps the private key, so the local client and user cannot decrypt the resulting archive; the author’s tests also found that the visible snapshot/indexing toggles did not stop capture. A filesystem-level immutable checkpoint directory is offered as a workaround, at the cost of rollback.
The author notes the write-up was AI-translated. HN discussion challenged the terminology and the reliability of a separate AI-paraphrased summary, but the original post includes the client-side evidence, archive measurements, and reconstructed upload flow.