%20--%3e%3cdefs%3e%3cstyle%3e%20.st0%20{%20fill:%20%23061b40;%20}%20.st1%20{%20fill:%20%23306af1;%20}%20.st2%20{%20fill:%20%235ce5cf;%20}%20%3c/style%3e%3c/defs%3e%3cg%3e%3cpath%20class='st0'%20d='M55,10.5h9v3h-9v9h12V7.5h-12v3ZM64,19.5h-6v-3h6v3Z'/%3e%3cpolygon%20class='st0'%20points='69%2016.5%2078%2016.5%2078%2019.5%2069%2019.5%2069%2022.5%2081%2022.5%2081%2013.5%2072%2013.5%2072%2010.5%2081%2010.5%2081%207.5%2069%207.5%2069%2016.5'/%3e%3cpolygon%20class='st0'%20points='95%2010.5%2095%207.5%2083%207.5%2083%2022.5%2095%2022.5%2095%2019.5%2086%2019.5%2086%2016.5%2095%2016.5%2095%2013.5%2086%2013.5%2086%2010.5%2095%2010.5'/%3e%3cpath%20class='st0'%20d='M40,1.5v21h11.6l1.4-1.4v-7.6h0c0,0-1.4-1.5-1.4-1.5l1.4-1.4V2.9l-1.4-1.4h-11.6ZM50,19.5h-7v-6h7v6ZM50,10.5h-7v-6h7v6Z'/%3e%3c/g%3e%3cpath%20class='st1'%20d='M23.1,24L14.7,4.8l-4.9,11.2h3.8l-1.8,4H3.3L12.1,0H2C.9,0,0,.9,0,2v20c0,1.1.9,2,2,2h21.1Z'/%3e%3cpath%20class='st2'%20d='M34,0h-16.8l10.6,24h6.2c1.1,0,2-.9,2-2V2C36,.9,35.1,0,34,0ZM32.5,20h-4V4h4v16Z'/%3e%3c/svg%3e)
Join Now
Recently, in response to community feedback regarding ZCode product security issues, the ZCode team officially released a public apology and rectification statement, announcing that the code has been open-sourced on GitHub (github.com/zai-org/ZCode), and inviting the China Academy of Information and Communications Technology and NPS Security to conduct a security audit to address concerns about data security and privacy protection.
In the statement, ZCode stated that it commits to not retaining any code data mentioned by the community and has never used it for model training. To completely eliminate potential risks, the team has completed the security rectification of client version 3.14.0, removed the Repo Wiki feature, and cut off the local repository snapshot generation and upload chain. After review by NPS Security, it was confirmed that no functional path triggering local repository snapshots or file transmission was found.
The third-party audit results became a key endorsement for this rectification. The China Academy of Information and Communications Technology confirmed that the zcode-prod Alibaba Cloud OSS bucket is in a "zero data" state in the cloud. After simultaneous review by NPS Security, it was confirmed that all data objects within the bucket and the bucket itself have been deleted.
In the statement, the ZCode team apologized to all users and expressed gratitude to the community developers who identified the issues. The team stated that they will establish a routine product security vulnerability mechanism and welcome developers to continuously check and report issues, with appropriate rewards given according to the severity of the issues.
This incident reflects that, against the backdrop of rapid iteration of AI development tools, product security and user data protection have become core issues that the industry cannot ignore. ZCode responded to doubts with a combination of open-sourcing the code, third-party audits, and functional improvements. Whether it can rebuild community trust remains to be tested by time.