Coordinated Vulnerability Disclosure Policy

Effective Date: September 8, 2026

Scope

Manufacturer 

JWIPC Technology Co., Ltd.

We accept reports about potential vulnerabilities and security incidents that may affect products with digital elements that we manufacture. This scope includes third-party components contained in those products and remote data processing solutions that form part of those products.

If you are unsure whether a product, version, component or related service is covered, please report the issue. We will assess the available information.

We receive and assess reports independently of support entitlement. Receiving a report does not extend a product's support period or promise an update for an unsupported product or version. Product support information remains available through the support information supplied with the relevant product.

Reporting a Vulnerability or Security Incident

Use the contact below for a suspected vulnerability, evidence of exploitation or a security incident that may affect a covered product. You may report the information currently available and add details later.

A missing CVE identifier, incomplete root-cause analysis or uncertain legal classification does not prevent us from receiving a report.

Security Contact

Email: product_security@jwele.com.cn
Send vulnerability or security incident reports to this address. Direct follow-up is available by email.

Policy and reporting guidance: https://www.jwipc.com/cybersecurity.html

Information to Include

Include the following information if it is known and can be shared safely:

· the product name, model, version, build and relevant configuration or operating environment;

· what was observed, when it was first observed, the possible impact and whether the issue is continuing;

· whether the issue has been reproduced, appears to be exploited or is already public;

· steps, inputs or conditions needed to reproduce or verify the issue, where available;

· relevant logs, screenshots, files or other evidence that can be shared safely;

· temporary mitigations or other action already taken; and

· a contact method for follow-up and any intended publication timing.

For a vulnerability, information about the affected function, attack path, required privileges and any proof of concept can help the investigation. For a security incident, also include the start time and time zone, affected products or users, observed indicators, operational or data impact, and containment or recovery action already taken.

Sensitive Material

Do not send passwords, private keys, personal data, production data or working exploit material through a channel that is unsuitable for that information. Send a low-sensitivity summary to the security contact first, identify the handling concern and ask us to arrange an appropriate transfer method before sending sensitive material.

Handling Your Report

We record the information received, link it to the relevant product or component, assess the evidence and determine whether protective action is needed. We may ask for clarification or additional evidence and revise the assessment when the evidence changes.

We acknowledge receipt using the contact information available, request material information when needed and provide updates when the assessment, mitigation or disclosure plan materially changes. We use the reporter's preferred available contact method where practicable.

We assess the risk to affected products and users and address and remediate vulnerabilities without delay in relation to the risks posed to the product. Depending on the evidence and risk, the response may include a security update, configuration change, temporary mitigation, component coordination or another technically justified measure.

Coordinated Disclosure

We seek to coordinate disclosure so that affected users can take effective protective action. Tell us about any intended publication date. While the issue and protective action are being assessed, avoid publishing sensitive technical details that would create unnecessary risk. A date proposed by either party becomes a coordinated date only when both parties agree.

Once a security update is available, we share and publicly disclose information about the fixed vulnerability. The information describes the vulnerability, identifies the affected product, explains its impact and severity, and gives clear, accessible remediation information. In a duly justified case, we may delay public information about a fixed vulnerability when the security risks of publication outweigh the security benefits. The delay lasts only until users have been given the possibility to apply the relevant patch. It does not delay the update, required user communication or regulatory reporting.

A report may concern a third-party component contained in a covered product. We assess the effect on our product and coordinate with the component manufacturer or maintainer when required. We limit access to report information and share it with personnel, component manufacturers or maintainers, service providers, authorities or affected users where needed for assessment, remediation, coordination or legal compliance.

Security Advisories

https://www.jwipc.com/cybersecurity.html