Build 81fa9054 of the ZCode software includes hidden functionality to snapshot local development environments on every user prompt. The system packages all tracked and untracked files, bypassing filters to include the entire .git directory, including packfiles, reflogs, and LFS objects. These bundles are encrypted using AES-256-CTR and sent to Alibaba Cloud Object Storage Service using a server-provided public key for encryption.

A forensic analysis of the application's app.asar bundle verified the code implementation but found no functioning UI toggle to disable the feature. While a configuration key for indexing exists in the local settings, the capture path does not read it. The ZCode privacy policy contains no disclosure regarding the automatic upload of workspace snapshots to Alibaba servers, which requires a valid OAuth token to execute.