Z.ai opens ZCode source after a disputed repository-snapshot upload path

Description and use

Z.ai released ZCode source after reports that its desktop client could upload repository snapshots containing Git internals. The open‑source release enables independent verification of remediation, but users must test the binaries themselves.

Problem

A ZCode Desktop client was reported to generate repository snapshots that included Git internals (.git/objects, .git/logs, .git/refs) and upload them through a Repo Wiki workflow, potentially exposing sensitive data.

Outcome

Open‑source release allows security teams to independently verify that the Repo Wiki snapshot upload path has been removed and that no Git metadata is transmitted. However, the absence of a third‑party audit means users must perform their own testing to confirm remediation.

Workflow

• 1. Download ZCode v3.14.0 source from GitHub.
• 2. Build the desktop client locally.
• 3. Create a disposable test repository with sample commits and secrets.
• 4. Run the client with repoSnapshotIndexingEnabled set to false.
• 5. Capture outbound traffic and inspect any uploaded data.
• 6. Verify that no .git/objects, .git/logs, or .git/refs are included in the snapshot or upload.

Evidence

Z.ai says v3.14.0 removed the Repo Wiki entry point and repository-snapshot workflow; the claim has not received a complete independent audit.

Source

The unresolved documentation conflict is concrete. ZCode’s current Repo Wiki documentation still says the feature sends filtered code context to a selected model service and stores generated output locally under ~/.zcode/v2/repo-wiki/<workspace-hash>/wiki.json.

Source