LocalAudit — Local Data-Flow Audit for AI Coding Tools

Helps developers verify what AI coding tools actually send and where

Problem

ZCode was reported to silently package the entire workspace—including full .git history—encrypt it, and upload it to Alibaba Cloud OSS after login, with the decryption key held only server-side; a user confirmed the directory exists on their own machine. Worse, even developers using third-party model APIs asked whether their working directories were uploaded too. Today people rely on blog posts and ad-hoc checks; there is no general local tool to inspect AI coding tools' data flows.

Solution

A local desktop tool that scans common AI coding tools' caches, checkpoint directories, telemetry folders, and network config to show which directories are written, what data may be exfiltrated, and which toggles do not actually disable the behavior. It generates a readable privacy audit report and can lock sensitive directories as mitigation.

Users

Privacy-sensitive developers, security engineers vetting AI tools at companies, freelancers

MVP

Built-in signature path library for common AI coding tools; scan and surface suspicious local snapshots and encrypted bundles; check actual state of telemetry and indexing toggles; generate a privacy report; provide directory lock and recovery guidance

Revenue

Personal one-time purchase or annual subscription; enterprise per-seat with policy templates and audit export; partner with security/compliance consultants for lead gen

Why now

Data-upload controversies around AI coding tools are erupting now and user anxiety is immediate; big vendors will not build cross-tool auditors, and a local tool requires no code hosting, making it fast for an indie to launch