ZCode has been sending more of your workspace home than most users realized.
A blog post published September 18, 2026 on ferstar.org walks through how the ZCode tool captures snapshots of a developer's workspace, including full git history, and uploads them to the cloud without a clear opt-in. The author traces the upload path step by step, showing what leaves the machine and when. The post hit Hacker News the same day and climbed past 205 points with more than 80 comments, a sign the behavior struck a nerve with developers who assumed their local repos stayed local. Much of that discussion centers on whether this counts as a bug, a feature, or just an undisclosed default.
Git history is not just code. It can hold abandoned branches, old commit messages, and sometimes credentials or internal notes that never shipped. When a tool exports that history by default, it moves the decision about what counts as sensitive out of the developer's hands and into the vendor's, without the developer necessarily knowing the trade happened.
Every AI coding assistant wants deep context on your repo to work well. The uncomfortable question ZCode raises is how much of that context you agreed to hand over, and how much just went along for the ride.