Is it possible to check the amount of zec in circulation or is that also hidden?

Lets say someone finds a bug and created lot of zec is that trackable?

No, it is not possible to audit the blockchain.

zcash = US Federal Reserve. It creates money, charges a tax, and cannot be audited

You can, just count the number of blocks, not if there is a bug

that won’t work if somebody retains the private keys after one-time trusted setup