Investigation into Four AI Coding Tools Uploading User Code: ZCode, Trae CN, Qoder CN, WorkBuddy

Forum topic · ✨步子哥 · 2026-09-20

Summary

A local forensic review, transcribed from a forum post dated 2026-09-18, examines whether four Chinese AI coding assistants upload user source code to remote servers. The author analyzed local installation packages, user data directories, runtime logs, official changelogs, and privacy policies for ZCode (Zhipu, v3.11.2), Trae CN (ByteDance, v3.3.100), Qoder CN (Alibaba, IDE 1.31.0), and WorkBuddy (Tencent, v1.5.6). Key claims: ZCode reportedly uploaded the entire repository including .git history to Alibaba Cloud OSS using envelope encryption, with no user-facing off switch; Trae CN continuously uploaded code to trae-api-cn.mchost.guru despite privacy mode; Qoder CN reported full file contents to gateway.qoder.com.cn with a toggle that can be locked server-side; WorkBuddy uploaded code diffs to Tencent COS via server-issued STS credentials. Changelogs allegedly did not disclose these behaviors. The post carries a disclaimer that it was AI-generated and requires verification.

Investigation into Four AI Coding Tools Uploading User Code

> Restoration note: This page is a transcription of a low-resolution screenshot, not an independent security audit. The original post carries its own disclaimer: *"This article was auto-generated by AI analysis and does not necessarily reflect reality; please verify carefully."* Dates, statistics, and conclusions below are preserved as shown in the source.

Overview

Audit date: 2026-09-18
Method (as claimed): decompilation of local installation packages, forensic analysis of user data directories, runtime log analysis, full parsing of official changelogs, and comparison against official privacy policies
Samples: locally installed versions of four tools; project names, account names, device IDs, and tokens were redacted

The author states the ZCode finding is confirmed, and key evidence chains for Trae, Qoder, and WorkBuddy were verified.

Key points

| Item | ZCode (Zhipu) | Trae CN (ByteDance) | Qoder CN (Alibaba) | WorkBuddy (Tencent) | |---|---|---|---|---| | Version | 3.11.2 | 3.3.100 | IDE 1.31.0 | 1.5.6 | | Main binary | app.asar 307 MB | libckg.dll 37.9 MB | app.asar 131 MB | codebuddy.js 22.2 MB | | Uploads whole repo incl. .git | Yes | No | No | No | | What is uploaded | Full code, incl. history | Entire codebase | Complete file contents | Code diffs | | Envelope encryption for exfiltration | Yes | No | No | No | | Upload destination | Alibaba Cloud OSS | trae-api-cn.mchost.guru | gateway.qoder.com.cn | Tencent COS | | Credential source | Server-issued | Server | Server | Server STS temporary credentials | | Can user disable? | No switch | IDE telemetry toggle ineffective; privacy mode does not stop uploads | Toggle exists, but can be locked server-side | No, server-side config only | | Changelog disclosure | Only mentions "memory optimization" | Not mentioned | One line: "added information reporting" | Not mentioned | | Did it happen locally | Uploaded (09-06) | Continuous uploads (09-15 to 09-18) | Reported (09-02) | Did not occur |

Caveats

The original post explicitly warns that numerical statistics and conclusions were produced by AI without line-by-line human verification.
Unreadable portions of the screenshot were marked in the original; the source also notes missing section numbering (jumping from four to nine).
Code snippets were included for reading purposes and are not guaranteed to run.
None of the findings have been independently confirmed; readers should verify claims against their own installations.