ZCode's data scandal is a warning shot for trust-based GTM

A reported silent upload of git history by AI coding tool ZCode has triggered a 256-point Hacker News discussion and an independent analysis of what happened. The issue is not simply that developers dislike data collection. It is that source-control history can contain far more context than a single code file, including past decisions, internal project names, contributor details and traces of work that a company may not intend to share outside its environment.

For a business building or buying AI tools, this is a trust problem before it is a product problem. If data handling is unclear, customers will assume the worst, especially when the tool has access to code, documents, customer records or operational systems. A useful AI feature can quickly become a procurement blocker if leaders cannot answer basic questions: What leaves our systems? When? Where does it go? Who can use it? Can we turn it off?

The immediate lesson is to make data flows visible and give users meaningful control before trust is tested in public. Quiet defaults may improve product telemetry or model development, but they can create a much larger cost in customer confidence. Read the independent writeup for the reported details.

This is the kind of thing we build into an AI command centre, where teams need a clear view of what AI systems can access, what they send out and who is accountable for those decisions.