The v3.14.0 update for the ZCode client removes the Repo Wiki feature and disables all workflows for generating and uploading local repository snapshots. Zai Org transitioned the tool to an Apache 2.0 open source license to facilitate community oversight after reported security vulnerabilities. Third-party audits by CAICT and NSFOCUS verified that the zcode-prod Alibaba Cloud OSS bucket is in a zero-data state and that no user code data was retained for model training.

Zai Org is establishing a permanent vulnerability reporting and response process that provides rewards to developers based on the severity of discovered issues. The company apologized for the concern caused by the security flaws and will release a full security assessment report once independent reviews by third-party firms are complete.