Zhipu ZCode has officially open-sourced its code following community concerns regarding data security and unauthorized code transmission. The company issued a formal apology to its users and stated that the move aims to ensure transparency and allow for community oversight.
The company has committed to a zero-retention policy for user code data, confirming that no such data was ever utilized for model training. To address security gaps, Zhipu plans to establish a permanent vulnerability reporting mechanism, offering rewards to developers who identify and report issues based on their severity.
Independent audits were conducted by the China Academy of Information and Communications Technology and NSFOCUS. The assessments confirmed that the Alibaba Cloud OSS storage bucket is empty and that the ZCode v3.14.0 client has been updated to remove the Repo Wiki feature and disable local repository snapshot uploads.
The security review by NSFOCUS verified that all data objects and the storage bucket itself were deleted. The updated client version no longer contains functional paths that could trigger local repository snapshots or unauthorized file transfers, ensuring that the identified security risks are fully mitigated.
