I gave xAI a lot of shit for Grok Build’s repo-upload behavior, so they deserve the same volume when they fix it. I pulled the new signed release, planted fake secrets, and captured its HTTPS traffic with MITM proxies. The fix held as retention was off on first login and had no /v1/storage, GCS traffic or Git bundle, and none of my canaries left the machine. Telemetry still runs, but I found no prompts, code, filenames, or secrets inside it. They published the source and the privacy-gate tests passed 5/5. Attaching my investigation here github.com/arafatkatze/gr… Max respect to the team for taking accountability and making a verifiable fix.