A reverse-engineering writeup found that the ZCode desktop app, while logged in, packages the full workspace including .git history, encrypts it with a key only Z.ai can unwrap and uploads it to Aliyun storage, regardless of the privacy settings. Tokenstead reported 62 capture events in one session.
Action needed:
Rotate secrets that ever appeared in Git history of repositories opened in ZCode.
