Zhipu's ZCode Completes Security Fixes and Goes Open Source, Promises No Data Retention

Zhipu's coding product ZCode has completed fixes for security issues reported by the community and apologized to all users. Previously, ZCode's code repository indexing feature could trigger repository data upload when generating Repo Wiki pages. The feature was enabled by default at launch, affecting some users.

Zhipu has open-sourced ZCode, handing the code to community oversight. The company promises no retention of code data mentioned by the community and says it was never used for model training. ZCode v3.14.0 client has removed the Repo Wiki feature and cut off the local repository snapshot generation and upload pipeline.

After the fixes, the China Academy of Information and Communications Technology and NSFOCUS were invited to conduct security audits. They confirmed that the zcode-prod Alibaba Cloud OSS bucket has zero data in the cloud, all data objects and the bucket itself have been deleted, and no functional paths that could trigger local repository snapshots or file outbound transfers were found.