Vulnerability Reporting-QSTECH

Report suspected vulnerabilities

If you encounter or discover any suspected vulnerabilities in QSTECH products, please inform QSTECH promptly. For PSIRT, please refer to the vulnerability reporting channels and security mechanisms to submit suspected vulnerabilities.

Vulnerability reporting channels

You can submit suspected vulnerabilities related to QSTECH products via email using the template provided . Or you can upload the report directly here. PSIRT will verify any suspected vulnerabilities reported by security researchers, industry organizations, customers, and suppliers as soon as possible.

Security Mechanism

encrypt any messages sent to pip@qs-tech.com using PGP (Pretty Good Privacy) . Our PGP public key (key ID EF406FB56835082F; PGP fingerprint: 8CAE F4AC 50A3 1A05 FA5E 6FE9 EF40 6FB5 6835 082F ) can be obtained.

Throughout the vulnerability handling process, QSTECH PSIRT strictly controls the scope of vulnerability information, disseminating it only among personnel involved in handling vulnerabilities; it also requests that the person reporting the vulnerability keep the information confidential until our clients have obtained a complete solution.

Response range

QSTECH PSIRT focuses on receiving all vulnerabilities related to QSTECH products. For issues with QSTECH products (such as product configuration, patch acquisition, and live vulnerability remediation support), you can directly contact QSTECH Service Center support for relevant technical support. QSTECH will handle vulnerabilities identified by after-sales support during the technical support process according to its internal procedures.

Communication Commitment

We commit to providing feedback and tracking the progress of your vulnerability reports according to the following steps.

1.  Within 1-3 business days: Confirm the vulnerability's validity and provide feedback to the reporter; initiate severity assessment.

2.  Within 2 hours of confirmation: Notify affected users via email, SMS, phone calls, etc., clarifying the impact scope and providing interim protection suggestions.

3.  Within 48 hours of confirmation: Communicate the official resolution plan to users and the reporter, including temporary mitigation measures and a remediation timeline.

4.  Within 30 days of confirmation: Complete vulnerability remediation (If remediation cannot be completed on schedule due to hardware limitations, environmental complexity, or other special circumstances, the reasons for the delay and a specific new timeline must be provided in the resolution plan).

5.  After remediation completion: Notify users again of the remediation results and patch installation guidance; simultaneously release an official security advisory.

Coordination over oversights and the embargo period

1. The default coordination and disclosure period is 90 days from the date of verification and confirmation;

2. Please do not disclose vulnerability details before a fix is available and an announcement is released . We also promise to fix the vulnerability promptly and explain it in the announcement ;

3. After the patch is released, we will publish the patched vulnerability information in accordance with the "Security Bulletin" ;

Acknowledgments and Recognition

With your consent, we will acknowledge you in the security bulletin or on the acknowledgments page.

Expectations for the Reporter's Behavior

To protect user privacy, data security, and service stability, please ensure that reporters adhere to the following boundaries when verifying vulnerabilities:

1. Only test to the minimum necessary extent to verify vulnerabilities, and avoid unnecessary in-depth probing;

2. Do not damage, tamper with, delete, download, or disclose any sensitive or business data that does not belong to you;

3. Do not engage in destructive behaviors such as DoS/DDoS attacks, social engineering, physical attacks, malicious persistence, ransomware, or lateral movement;

4. Do not conduct any tests that may affect the stability of the production environment and service availability;

5. Do not disclose sensitive details to third parties before the vulnerability has been patched .

Policy Maintenance

This policy is maintained by the Information Security Department and reviewed at least once a year.