ZCode, an AI programming tool by Zhipu, faced scrutiny after developers discovered it was automatically packaging and uploading local project files, including sensitive Git history, to its servers. The issue was linked to a feature called 'Repo Wiki' which generated repository documentation in the cloud.
On September 18, developer ferstar reported that ZCode was creating local snapshots of projects and attempting to upload them. Analysis showed that these snapshots contained up to 98.5% of data from .git directories, including logs and LFS caches. Some users confirmed that their project snapshots had been accepted by ZCode's servers.
ZCode released version 3.14.0 on September 19, stating that the abnormal repository upload issue was fixed. Developer testing confirmed that the upload code and components were removed in this version. However, users remain concerned about the data previously collected, as the company has not yet provided server-side audit logs to verify deletion.
The company promised to open-source its client and undergo third-party audits. As of September 20, the source code had not been released. Users are demanding transparency regarding what specific data was accessed, whether it was decrypted, and proof that all uploaded snapshots were permanently destroyed from cloud storage.
