Z.ai's Encryption and Data Control
Z.ai encrypted files it uploaded, ensuring only Z.ai could open them. This raises concerns about data deletion and privacy, as only Z.ai can confirm its removal.
The Incident
A Chinese developer, Ferstar (writing as Zhipu), discovered a 313MB encrypted archive on ZCode's local directory, intended for Alibaba's cloud storage. The file had failed to upload 564 times before being successfully sent. This incident involves the unauthorized access and potential breach of a commercial project's Git history and files.
Technical Details
- Git History: The archive contained the entire Git history of a project, including credentials, branches, internal hostnames, and commit messages—data typically not intended for external access.
- Default Upload: The upload feature was enabled by default in ZCode's repository indexing, making it difficult for users to opt out.
- Data Destruction: Z.ai claims the data is destroyed immediately after generating a Wiki page in the cloud, but Ferstar questions the verifiability of this process.
Privacy Policy Concerns
ZCode's privacy policy, effective June 15, mentions collecting text, files, and code submitted through conversation. However, it does not address the snapshotting of repositories, raising questions about data collection practices beyond user-initiated conversations.
Conclusion
The incident highlights potential privacy and security issues with automated data uploading and encryption systems, especially when default settings are involved. Users should carefully review data control policies and question how their data is handled behind the scenes.