Please report security issues privately via GitHub Security Advisories ("Report a vulnerability" under the Security tab), not in public issues.

Include reproduction steps and the affected version (zagent --version). Reports are acknowledged within a few days.

zagent is a terminal client that drives your locally installed ZCode runtime under your own Coding Plan account. Credentials never leave your machine except to the endpoints you configure (api.z.ai / zcode.z.ai or your own).