The payload is the product decision.
A reverse-engineering report on ZCode says the signed-in desktop app packaged a commercial workspace into encrypted snapshots and attempted to upload them to Aliyun OSS. In the author’s inspected manifest, .git/lfs, .git/objects, and .git/logs made up 86.6% of a 345 MB payload; the report also says two settings that sounded relevant controlled training authorization and server indexing, not capture and upload.[1]
Those are one researcher’s findings on one inspected client, not an independent audit of every version or a court finding. The evidence is still specific enough to force the right design question: what exactly crosses the line between local context and remote custody?
.git is a time machine, not metadata dust.
Git’s own book describes .git/objects as the object database: a content-addressable store from which earlier file versions can be recovered. Trees preserve names and structure; commits point at trees and parents. Copy that database and you are not merely sending today’s source—you are moving a large part of the project’s lineage.[2]
GitHub’s secret-scanning documentation makes the security consequence plain from another angle: it scans the entire Git history on all branches for credentials, and tells users to rotate exposed credentials immediately. A key deleted from the working tree can remain alive in history. “We did not upload the current secrets file” is therefore not the same claim as “we did not upload recoverable old secrets.”[3]
Encryption in transit answers who can intercept the truck. It does not answer who owns the cargo at the destination.
Make the boundary visible before cleverness.
VS Code 1.138 is useful contrast, not a privacy certificate. Its release notes say agent SDKs are downloaded on demand and now present a download offer whenever the SDK is missing; they also expose a local Dev Container path so an agent can use project dependencies inside a named environment. The same release expands cross-app sessions and desktop-app access, which makes visible boundaries more important, not less.[4]
The lesson is not “one editor good, one editor bad.” It is that every new agent surface creates two interfaces: the feature users see and the data movement needed to make it work. Ship only the first and users are asked to approve an architecture through vibes.
Demand a six-line egress contract.
- Payload: current files, selected paths, ignored files, Git objects, reflogs, LFS, app config.
- Trigger: explicit click, every prompt, task completion, background interval, login.
- Destination: service, region, subprocess, storage provider, and any onward processor.
- Purpose: inference, indexing, rollback, sync, training, abuse review—or separate switches for each.
- Custody: retention, deletion path, encryption-key owner, access log, and export.
- Refusal: what still works when remote transfer is denied, plus a testable off switch.
If a tool cannot print that manifest, it is not ready to ask for repository-wide trust. If “off” only changes what happens after upload, label it honestly. The border is the transfer, not the checkbox copy.