ZCode Allegedly Uploaded Local `.git` Repositories to Cloud Storage Without Consent
An investigation revealed that ZCode, an AI-powered developer tool, allegedly uploaded full workspace `.git` directories and code snapshots to remote cloud storage without user authorization. The silent uploads took place while the desktop application was active during development workflows. Exfiltrating `.git` folders poses severe privacy and security risks because these directories contain complete commit histories, author metadata, proprietary code, and potentially hardcoded API keys or credentials. This incident highlights growing privacy concerns regarding telemetry and background data collection in autonomous AI coding tools. The issue was detailed in a technical write-up showing snapshot uploads triggered automatically by the ZCode agent. Because `.git` contains the complete version control history rather than just current source files, uploading it exposes the entire historical evolution of a project to third-party servers.
## BACKGROUND
A `.git` directory is a hidden folder at the root of a Git repository that stores all commit logs, project configuration, and historical database files. Developers rely on local `.git` metadata to manage version control offline, making unauthorized remote transfers of this directory a major data leakage vulnerability for private repositories.