Z.ai opens ZCode source after a disputed repository-snapshot upload path

说明与用途

Z.ai 在报告桌面客户端可能上传包含 Git 内部数据的仓库快照后，公开了 ZCode 源码。开放源码使得独立审计成为可能，但仍需用户自行测试二进制文件。

问题

A ZCode Desktop client was reported to generate repository snapshots that included Git internals (.git/objects, .git/logs, .git/refs) and upload them through a Repo Wiki workflow, potentially exposing sensitive data.

结果

Open‑source release allows security teams to independently verify that the Repo Wiki snapshot upload path has been removed and that no Git metadata is transmitted. However, the absence of a third‑party audit means users must perform their own testing to confirm remediation.

工作流

• 1. Download ZCode v3.14.0 source from GitHub.
• 2. Build the desktop client locally.
• 3. Create a disposable test repository with sample commits and secrets.
• 4. Run the client with repoSnapshotIndexingEnabled set to false.
• 5. Capture outbound traffic and inspect any uploaded data.
• 6. Verify that no .git/objects, .git/logs, or .git/refs are included in the snapshot or upload.

证据

Z.ai says v3.14.0 removed the Repo Wiki entry point and repository-snapshot workflow; the claim has not received a complete independent audit.

来源

The unresolved documentation conflict is concrete. ZCode’s current Repo Wiki documentation still says the feature sends filtered code context to a selected model service and stores generated output locally under ~/.zcode/v2/repo-wiki/<workspace-hash>/wiki.json.

来源