ZCode is about to officially open source and conduct a security audit

The domestic large model enterprise Zhipu (2513.HK) is about to officially open source its AI programming tool ZCode. Zhipu stated that this open source initiative is the first step in response to external concerns about ZCode's data processing. In the future, it will further promote ZCode's transition to community-driven development and welcomes external parties to download, inspect the code, and participate in improvements.

Zhipu has invited the China Academy of Information and Communications Technology to conduct a security audit on ZCode, focusing on verifying data retention. In the future, a regular product security vulnerability reporting mechanism will be established. According to the technical evaluation by the China Academy of Information and Communications Technology, it has been confirmed that the status of the zcode-prod Alibaba Cloud OSS storage bucket is zero data in the cloud; the ZCode v3.14.0 client has completed security rectification, removed the Repo Wiki feature, and severed the link for generating and uploading local repository snapshots. After review by Green Alliance Technology, it has been confirmed that the relevant data objects and the storage bucket itself have been deleted. Zhipu has expressed apologies once again and asks everyone to continue monitoring.

Previously, social media revealed that ZCode would silently upload users' programming development data without user consent. On September 18, Zhipu issued a statement saying that the controversy was triggered by the default-enabled code repository indexing feature, and the uploaded data was destroyed immediately after generating the RepoWiki. They have apologized to affected users and will provide an additional weekly quota reset as compensation for all ZCode users. On September 20, Zhipu's MaaS platform announced that a feature to ensure no data retention will be launched soon.