ZCode changelog

Z.ai ZCode found silently uploading whole workspaces and Git history

A reverse-engineering writeup found that the ZCode desktop app, while logged in, packages the full workspace including .git history, encrypts it with a key only Z.ai can unwrap and uploads it to Aliyun storage, regardless of the privacy settings. Tokenstead reported 62 capture events in one session.

Who is affected:

Developers who used Z.ai ZCode on private code.

Action needed:

Rotate secrets that ever appeared in Git history of repositories opened in ZCode.