Transition to Open Source Following Security Remediation
ZAI has announced the open-source release of ZCode, moving the software to a public repository on GitHub under the Apache 2.0 license. The release includes the desktop application, web workspace, backend, Agent CLI, and runtime. According to an official announcement from the company, the decision to open-source the code is intended to increase transparency and allow for community scrutiny following previously reported security issues.
The move follows a period of scrutiny regarding how the platform handled user data. In response to community concerns, ZAI confirmed that no user code data has been retained and that such data has never been used for model training.
Security Assessments and Remediation Measures
To address reported vulnerabilities, ZAI engaged the China Academy of Information and Communications Technology (CAICT) and NSFOCUS to conduct technical security assessments.
The CAICT assessment confirmed that the zcode-prod Alibaba Cloud OSS bucket is in a “zero-data state.” Furthermore, the company stated that security remediation has been implemented in the ZCode v3.14.0 client. Key changes include the removal of the Repo Wiki feature and the disabling of workflows used to generate and upload local repository snapshots.
In a separate assessment, NSFOCUS confirmed that all data objects within the zcode-prod Alibaba Cloud OSS bucket, as well as the bucket itself, have been deleted. NSFOCUS also reported that no functional paths capable of triggering local repository snapshot generation or the external transmission of local files were identified in the ZCode v3.14.0 client. ZAI has stated that a full security assessment report will be released in the near future.
Community Response and Technical Observations
The announcement has drawn mixed reactions from the developer community on platforms such as Reddit. While some users noted that the move is a significant step toward regaining user trust, others expressed skepticism regarding the platform’s original utility.
Some unverified commentary on Reddit suggested that the software might have functioned more as a data collection tool for ZAI rather than a primary coding assistant. Technical discussions among users also highlighted architectural differences between ZCode and other editors like Zed; specifically, users noted that ZCode is built on Electron, whereas Zed utilizes a custom renderer written in Rust to optimize performance.
Moving forward, ZAI has committed to establishing an ongoing vulnerability reporting and response process. The company has invited developers to continue reviewing the codebase and has pledged to provide rewards based on the severity of any reported issues.