Fresh security vulnerabilities uncovered in ZCode following its open-sourcing: the project's default encryption key can be calculated using the username and path.

Beating AI Express (Dongcha) – After ZCode was open-sourced, developers discovered a security vulnerability in its code. ZCode encrypts user login credentials for local storage, but by default, its decryption key can be directly calculated using the operating system, username, and user directory—information typically easy to access. Once attackers obtain ZCode’s stored credential files, they can regenerate the key via the open-source code without needing to crack the encryption algorithm. ZCode’s official documentation states these login credentials are “encrypted per device and cannot be decrypted after switching devices.” However, the open-source code’s default scheme does not use device IDs or hardware information, creating a mismatch between the official claim and the actual code. Notably, this is not a vulnerability enabling remote credential theft; attackers must first gain access to local credential files. If users set their own ZCODE_CREDENTIAL_SECRET, the default key scheme will not apply. In case of file leakage, login sessions for ZCode, Z.ai, or BigModel may be restored, potentially leading to account impersonation or Coding Plan quota misuse, though this will not result in computer hacking.