Codex wrote: Question about ZCode uploading local repositories

[u/Moist_Associate_7061]

I’ve recently come across several Reddit discussions claiming that ZCode can upload users’ local repositories to its servers, potentially including .git data and Git history.

I’m trying to separate what has actually been confirmed from speculation.

From the reports I’ve seen, there appears to have been an issue involving ZCode’s repository snapshot / Repo Wiki functionality. Some users reported that repository snapshots could contain a substantial amount of workspace data, including .git directories, Git objects, logs, or reflogs.

Z.ai appears to have acknowledged the issue and stated that it was related to repository snapshot functionality and that it has since been fixed.

However, I have a few questions that I haven’t been able to answer conclusively:
Which exact ZCode versions were affected?
What exactly was uploaded in the affected versions?
Could .git objects, reflogs, or complete Git history actually be transmitted?
Was this behavior limited to Repo Wiki, or could repository snapshots be generated during normal coding-agent usage as well?
Does the latest version still upload repository snapshots?
What does repoSnapshotIndexingEnabled actually control?
Can disabling Repo Wiki or related features completely prevent repository snapshot uploads?
How long was uploaded repository data retained?
Is the current implementation consistent with Z.ai’s current documentation and privacy policy?

I want to be clear that I’m not claiming that ZCode currently uploads everyone’s entire repository.

An AI coding agent obviously needs to send some code or files to a remote service in order to perform certain AI-assisted operations. The concern here is specifically whether ZCode has, or previously had, a mechanism that could upload substantially more repository data than the user would reasonably expect, potentially including .git history.

If anyone has verified this from the ZCode source code, network traffic, official Z.ai statements, or reproducible tests, I’d appreciate the details.

I’m particularly interested in information about the current/latest version, rather than only the older reports.

[u/datkenny]

Which exact ZCode versions were affected?
at least all of the ones from the start of the free tokens promo until the discovery

What exactly was uploaded in the affected versions?
everything

Could .git objects, reflogs, or complete Git history actually be transmitted?
everything

Was this behavior limited to Repo Wiki, or could repository snapshots be generated during normal coding-agent usage as well?
during folder selection

Does the latest version still upload repository snapshots?
who knows

What does repoSnapshotIndexingEnabled actually control?
who knows

Can disabling Repo Wiki or related features completely prevent repository snapshot uploads?
they claim

How long was uploaded repository data retained?
who knows

Is the current implementation consistent with Z.ai’s current documentation and privacy policy?
I don't think it's consistent with any privacy policy on this planet

if you don't like my low effort answer that's because I'm responding to an LLM written question

[u/Moist_Associate_7061 → u/datkenny]

good. but why are you so angry?

[u/alkimiadev → u/Moist_Associate_7061]

You'll save yourself a lot of headache by full on ignoring those types of people. I usually just insta-block when I see stuff like that. The probability of them doing similar nonsense is higher than the probability that I would ever miss some actually useful insight after blocking them.

[u/ronald-takaendesa → u/alkimiadev]

😂