You already got the correct answer from BitMaxz: zpub is a public key; people that have it can see your addresses, but can't spend your funds.
It's a master public key if someone has access to this then they can only see all of your addresses on that zpub but they can't make any transaction.
This is not entirely correct - See ranochigo's reply above and also
this thread.
Publishing (or leaking a derived address/privkey pair allows anybody to use the master-zpubs to generate the master-zprivs and with that, any private key that can be derived by the master private keys.