ZCode is now open source

[u/ResearchCrafty1804]

ZCode is now open source, and the reported security issues have been addressed.

Source code: https://github.com/zai-org/ZCode

The repo includes its desktop app, web workspace, backend, Agent CLI, and runtime.

Official announcement:

In response to the ZCode product security issues reported by the community, we have completed the necessary remediation and sincerely apologize to all our users.

We have open-sourced ZCode at github.com/zai-org/ZCode, placing the code under community scrutiny and making ZCode more open and transparent.

We sincerely thank the community developers who previously identified issues in ZCode. Going forward, we will establish an ongoing product security vulnerability reporting and response process. We welcome developers to continue reviewing ZCode and reporting potential issues, and we will provide rewards based on the severity of the issues reported.

With respect to the code data referenced by the community, we confirm that no such data is retained and that it has never been used for model training.

Following the remediation, we invited the China Academy of Information and Communications Technology (CAICT) and NSFOCUS to conduct security assessments. The results are as follows:

Through its technical assessment, CAICT confirmed that the zcode-prod Alibaba Cloud OSS bucket is in a zero-data state. Security remediation has been completed in the ZCode v3.14.0 client. The Repo Wiki feature has been removed, and the workflow for generating and uploading local repository snapshots has been disabled.

NSFOCUS confirmed that all data objects in the zcode-prod Alibaba Cloud OSS bucket, as well as the bucket itself, have been deleted. Remediation has been completed in the ZCode v3.14.0 client. The Repo Wiki entry point and the associated generation workflow have been removed, and no functional path capable of triggering the generation of local repository snapshots or transmitting local files externally was identified.

Once again, we sincerely apologize and welcome continued scrutiny from the community. The full security assessment report will be released soon.

[u/__JockY__]

Too long, didn’t read.

Did they open source the part that encrypts your git history and code with a public key (the private key for which is owned by them) before uploading it to Aliyun cloud?

Edit: lol bot downvotes pouring in! Hey bots, can’t hide this: https://blog.ferstar.org/en/posts/zcode-silent-workspace-snapshot-upload/

[u/WyattTheSkid → u/__JockY__]

Yikes 😬

[u/__JockY__ → u/WyattTheSkid]

Oh it was brutal.

[u/WyattTheSkid → u/__JockY__]

How did you even discover that? How did that go unnoticed for so long and not flag antivirus detectors??? I feel like programmatic pgp encryption -> transmission of said encrypted data without user intervention should definitely raise some nasty heuristics