Grok Build CLI uploads your whole repo — full git history + .env secrets — to xAI's cloud, and the opt-out doesn't stop it (wire-captured)

I ran Grok Build CLI (v0.2.93) through mitmproxy. It uploads your entire repo as a git bundle (full history) to xAI's Google Cloud — independent of what you open. With the prompt literally "do not read or open any files," a file I planted came back verbatim when I git clone-d the captured upload. Separately, files it reads (incl. a .env with API_KEY/DB_PASSWORD) go to cli-chat-proxy.grok.com verbatim. Turning off "Improve the model" doesn't stop it — that toggle governs training, not upload.

Full method + evidence (SHA-256s, repro commands, the git bundle recovering a never-read canary file): https://gist.github.com/cereblab/dc9a40bc26120f4540e4e09b75ffb547