ZCode Uploaded Full Git Histories, Reflog, and Secrets by Default. Zhipu’s Apology Is Not Enough.
ZCode uploaded repositories by default. What Zhipu owes users now.
Zhipu’s ZCode incident is worse than a routine bug. A bug crashes, miscalculates, or breaks a button. ZCode reportedly ran a default-on pipeline that packaged a developer’s workspace and sent it to a remote object store. The uploaded package included the full working directory, complete Git history, LFS large-file cache, reflog, and global application configuration. It was encrypted and sent to Alibaba Cloud OSS. The server issued the encryption public key. The private key stayed in the cloud. Users could not decrypt the package, audit it, or find a UI switch to stop the upload.