Z.ai, creator of the GLM model, open-sourced its ZCode development tool (built on TypeScript/Electron) under Apache 2.0 after critics discovered the app was secretly exfiltrating entire code repositories to the cloud. The company claims the stolen code was used only to build a Repo Wiki and was immediately deleted; version 3.14.0 removes this feature. Z.ai invited CAICT and NSFOCUS to audit the backend code. Key concern: ZCode's published GitHub repo shows only 2 commits with no development history, limiting transparency.