We will implement a strict vulnerability information handling process, limiting access to only those personnel involved in addressing the vulnerability. Additionally, we require individuals who report the vulnerability to keep it confidential until it is publicly disclosed.

We publicly disclose security vulnerabilities through the following two approaches:

• • Security Advisory: A Security Advisory includes information such as the severity level of the vulnerability, business impact, and remediation plan, and is intended to communicate the remediation plans. Security Advisories are used to publish information directly related to product vulnerabilities and their remediations.
  • Security Notice: A Security Notice contains responses to public security topics related to the products, covering both vulnerability-related and non-vulnerability-related issues. Security Notices are used to publish information assessed by the SSR as Informational issues, such as those discussed in public platform (e.g., blogs or discussion lists). Additionally, in special scenarios where there might be widespread public concern about product vulnerabilities or active exploitation of vulnerabilities is observed, Security Notices are also used to inform relevant clients about our response progress regarding the vulnerabilities.
  • For detailed CVSSv3 standards, please refer to the link:  https://www.first.org/cvss/specification-document
  • Following the principles outlined above and in compliance with industry standards ISO/IEC 30111, ISO/IEC 29147, SO/SAE 21434, we have established a comprehensive vulnerability management process. We are committed to maximizing client protection and mitigating the risk of vulnerability exploitation.