HITI Product Security Advisories

Product cybersecurity vulnerability disclosure policy

 

Article 1: Purpose

In accordance with the requirements of the EU's Cyber ​​Resilience Act (CRA), we plan to formulate and publicly announce our "Coordinated Vulnerability Disclosure (CVD)" policy and establish a Product Security Incident Response Team (PSIRT) as a dedicated handling unit.

 

Article 2: Scope of Application

This covers all hardware and software products developed, manufactured, and marketed by our company that have digital elements and are sold in the EU market, along with related support services.

 

Article 3: Content Description

I. Vulnerability Reporting Methods:
   (i) Researchers should report vulnerabilities to PSIRT through the protected official channels and should not disclose them to the public in advance.
   (ii) Official notification channels: Please fill in the relevant information and send it on the official vulnerability notification webpage.
   (iii) The notification should include:
1. The full name and valid contact information (including email address and telephone number) of the person notifying.
2. The name, description, and full version number of the affected product or software.
3. A complete and detailed description of the problem, background information, and relevant materials that help reproduce the problem (including clear reproduction steps, proof-of-concept code (PoC), screenshots, or explanatory videos).
4. The notifying party hereby declares that the content of this notification does not infringe upon the intellectual property rights of any third party.
 
II. Processing procedure:
  Upon receiving a vulnerability report, our company PSIRT will handle it according to the following procedures and timeline:
1. Confirmation of receipt: Our company will confirm receipt and begin verification within 3 business days.
2. Progress Update: We will provide a reasonable assessment response (acceptance or rejection) within 30 days of receiving the notification. If we decide to accept, we may provide a non-legally binding expected mitigation period; if we decide to reject, we will state the reasons, but we will remain in a review position if the notifying party provides new supplementary information.
3. Information Supplementation and Case Closure: If the PSIRT team requires additional information for verification, it will proactively contact the person who reported the issue. If the person who reported the issue has not received a response after two contacts and more than 14 business days have passed since the second contact was made, and the key information cannot be supplemented, the company reserves the right to close the case directly.
4. Vulnerability Remediation: Our company will prioritize remediation based on vulnerability severity, aiming for best effort to complete software remediation and mitigation within 90 days of initial acceptance. However, the remediation schedule may be extended due to the following force majeure or reasonable factors, and our company will not be liable for delays:
- Delays in remediation by the upstream vendor (Third-party Vendor).
- Significant changes to hardware or system architecture required.
- Constraints on product lifecycle resources.
- Deployment of the solution through multiple update channels, ecosystems, or different release frequencies.
5. Security Advisory: The company reserves the right to issue security advisories at its own discretion. All statutory notifications involving the EU CRA or other competent authorities shall be handled by the company's PSIRT; no one may notify external agencies or third parties on behalf of the company without authorization.
 
III. Safety Behavior Guidelines:
  Researchers conducting security testing must strictly adhere to the following guidelines and refrain from any actions that are destructive or infringe upon the rights of the company or any third party:
1. You must not exploit vulnerabilities to access, view, download, or modify unauthorized data, or compromise any data integrity.
2. You must not cause any potential or actual interference, paralysis or damage (including denial-of-service attacks DoS/DDoS) to the company's users, systems, databases, websites, services or applications.
3. Automated scanning tools must not be used to launch high-frequency brute-force attacks.
4. Testing must not employ social engineering, phishing emails, identity theft, physical intrusion, or extortion.
5. If unauthorized data is inadvertently accessed during testing, testing should be stopped immediately, data access should be limited to the minimum necessary for the proof of concept (PoC), and PSIRT should be notified immediately. The data must not be retained or copied.
6. Only test accounts held by the researcher may be used; prior written authorization from the account holder is required to use someone else's account.
7. Strict confidentiality obligations and Embargo Period: From the date of notification until the Company officially issues a security bulletin or obtains the Company's prior written consent, the notifier shall not disclose or reveal the existence, details, or reproduction method of the vulnerability to any third party in any form (including but not limited to personal blogs, social media, academic publications, seminars, or media interviews).
 
IV. Safe Harbor Clause:
   1. Disclaimer: If the notifier fully complies with all the provisions of this policy (including the code of conduct for security and confidentiality obligations) during the process of conducting cybersecurity testing and vulnerability reporting, and does not request any unapproved economic compensation or additional conditions, the Company promises to regard the behavior as good-faith cybersecurity research and will not bring civil or criminal legal action against the notifier for such testing behavior.
   2. Reservation of Rights and Prosecution: If the notifier violates any provision of this policy (including but not limited to unauthorized disclosure of vulnerability details, conducting destructive testing, or using the vulnerability for extortion/compensation), this safe harbor clause will automatically become invalid, and the company reserves all rights to pursue legal action (including criminal prosecution and civil damage claims).
 
V. Intellectual Property Rights and Licensing:
     The notifying party agrees that all notification materials, documentation, proof-of-concept (PoC) code, and related patch suggestions provided to the Company grants the Company a worldwide, perpetual, irrevocable, non-exclusive right to use, reproduce, modify, edit, and create derivative works thereof for vulnerability verification, patching, product security improvement, and public announcement. The notifying party warrants that such content does not infringe upon the intellectual property rights of any third party and shall not claim any patent or copyright-related economic benefits from the notified party based on it.
 
VI. Awards and Acknowledgements:
   1. Acknowledgments: After the vulnerability is patched and a security bulletin is released, with the prior written consent of the notifier, the Company may publicly recognize their cybersecurity contributions on the official website's acknowledgments page.
   2. No Bounty Statement: Our company does not currently implement a bug bounty program. Reporting is a non-compensated activity, and our company does not accept any form of economic compensation, commercial promotion or points conversion request.
 
VII. Service life and scope of security support:
   1. Support Period: For digital products that comply with the EU Cyber ​​Resilience Act (CRA), our company provides a product security support period of at least 5 years (or whichever is longer, starting from the date the individual product is placed on the EU market). During the support period, our company provides security updates and firmware/software patches free of charge.
   2. Handling after support termination: If new vulnerabilities are discovered after the product security support period expires, the company may provide risk mitigation and protection recommendations through security bulletins and reserves the right to stop providing direct firmware/software repair updates.

 

 

follow us on f      Copyright© HiTi Digital, Inc. All Rights Reserved       l       The site is best viewed at 1360x768 resolution on Chrome、Firefox or IE8 above.