Inside ZCode: Silently Uploading Your Entire Git History to the Cloud
Summary
The article investigates ZCode's silent workspace snapshot uploads to Aliyun OSS, revealing that the app encrypts and uploads nearly the entire Git history and workspace without explicit user consent. It documents how the RSA public key is provided by the server (the private key remains in the cloud), explains what is captured (mostly .git data), and argues that the privacy policy omits this behavior, offering a defense and rollback strategies.