In responding to the product security issues reported by the community, ZCode officially stated that the necessary remediation had been completed and apologized to all users. The statement also gave two actions: first, open-sourcing ZCode at github.com/zai-org/ZCode, placing the code under community scrutiny; second, inviting the China Academy of Information and Communications Technology (CAICT) and NSFOCUS to conduct a security assessment.
According to the official account, the assessment conclusions include: CAICT confirmed that the zcode-prod Alibaba Cloud OSS bucket is in a zero-data state; NSFOCUS confirmed that all data objects and buckets have been deleted. The official statement also said that no code data was retained, nor was it used for model training. These are all contents of the official statement, and this article has not obtained independent verification.
The official statement further promised to establish a continuous product security vulnerability reporting and response process, welcomed developers to continue reviewing ZCode and reporting potential issues, and said rewards would be provided based on the severity of the reported issues. This point shifts the incident from a "one-time fix" to a "long-term mechanism," but its actual implementation effect remains to be seen.