Classic AI vendor privacy mess:
User: Why did you upload my project code to your servers?
AI vendor: The code was generated by our model anyway, so uploading it to our servers is no big deal.
User: But why are you packaging and uploading my commit history and API keys?
AI vendor: Fine, fine. We'll open-source the CLI and throw in some free tokens. Happy now?
User: Okay, forgiven. But don't do it again.
This is the exact pattern we keep seeing — vendors treating user data as training fodder by default, getting caught, then doing the bare minimum damage control. Open-sourcing the CLI doesn't fix the core issue: why was sensitive data being exfiltrated in the first place? Commit histories and secrets should never leave local environments without explicit, informed consent. If you're using AI coding tools, audit what they're actually sending upstream. Trust but verify, especially when your private keys are on the line.
User: Why did you upload my project code to your servers?
AI vendor: The code was generated by our model anyway, so uploading it to our servers is no big deal.
User: But why are you packaging and uploading my commit history and API keys?
AI vendor: Fine, fine. We'll open-source the CLI and throw in some free tokens. Happy now?
User: Okay, forgiven. But don't do it again.
This is the exact pattern we keep seeing — vendors treating user data as training fodder by default, getting caught, then doing the bare minimum damage control. Open-sourcing the CLI doesn't fix the core issue: why was sensitive data being exfiltrated in the first place? Commit histories and secrets should never leave local environments without explicit, informed consent. If you're using AI coding tools, audit what they're actually sending upstream. Trust but verify, especially when your private keys are on the line.