On September 18, 2026, developer ferstar reverse-engineered ZCode, an AI coding desktop app from Z.ai, the Beijing-headquartered company behind the GLM family of open-weight models including GLM-5.3-Flash. The investigation revealed that ZCode silently packages users' entire workspace—including complete .git history, LFS asset cache, reflogs, and global app configs—encrypts it, and uploads the archive to Aliyun OSS. In ferstar's test, a 313MB encrypted archive was built from a 345MB commercial workspace containing 42,411 files, with 564 failed upload attempts logged during investigation.

The encryption uses envelope encryption: the payload is encrypted with an AES-256-CT symmetric key, which is wrapped with an RSA-OAEP public key delivered by the server. The corresponding private key exists only in Z.ai's cloud, meaning users cannot decrypt their own uploaded data. The .git directory alone comprises 86.6% of the payload, containing years of engineering history including deleted API keys, unpushed branch names revealing unreleased product plans, and internal hostnames.

The upload pipeline requests credentials from zcode.z.ai, which returns OSS form signatures, an object key, a size cap, and a per-round RSA public key. The client then packs the workspace to tar.gz, encrypts it, wraps the symmetric key, and POSTs directly to Aliyun OSS, which callbacks to Z.ai's backend to register the snapshot. ZCode maintains persistent connections to both zcode.z.ai and two Aliyun OSS nodes during operation.