According to CoinMeta, after ZCode was made open-source, developers discovered a security issue: the default encryption key could be directly calculated based on the operating system, username, and user directory. ZCode is designed to encrypt users' login credentials locally, but official documentation claims that these credentials are "encrypted per device and cannot be decrypted after switching devices." However, the default implementation in the open-source code does not utilize device ID or hardware information, which leads to a discrepancy between the official statements and the open-source code. Although attackers need to obtain the local credential files first, once these files are leaked, it is possible for the login state of ZCode, Z.ai, or Bigmodel to be restored, potentially allowing for unauthorized account use or consumption of coding and plan quotas. Nevertheless, this does not result in the computer being compromised.