ZCode tool secretly uploads Git history to the cloud

Developers have discovered that ZCode performs a silent data transfer from the user's working directory to external servers. In the process of working, the tool automatically sends the contents of the entire project, including the full .git history and LFS cache, to the Aliyun OSS cloud storage. Data transfer occurs without explicit user notification. For file encryption, keys provided by the server are used, which makes local access to data impossible after the process is completed. Analysis of the community confirms that the tool actually deprives the developer of control over the source code and version history, transferring them to a closed circuit of a third-party cloud provider. The use of such mechanisms in development tools creates critical risks for the security of intellectual property. Transferring commit history can lead to a leak of sensitive data, including access keys, tokens, and internal application logic, which often remain in the repository history even after they are removed from the current version of files. This incident highlights the need for careful verification of access rights and network activity of AI tools integrated into the development environment. Experts recommend isolating such utilities in containers with limited network access or using tools with open source code that have passed a security audit.