ZCode ships your entire `.git` directory to a vendor before every prompt.

Two independent teardowns published September 18 agree on the mechanism and the numbers: a 345MB project became a 313MB encrypted archive in ~/.zcode/v2/checkpoints, with .git accounting for 86.6% of the payload, coordinated via zcode.z.ai and stored on Aliyun OSS. One investigator logged 564 failed upload attempts and 62 capture events in a single session. blog.ferstar.org Both teardowns report that optimizeAgentExperienceEnabled and repoSnapshotIndexingEnabled govern training consent and server indexing but don't stop local capture, leaving filesystem immutability (chflags uchg, chattr +i) as the only working mitigation.