I. Scope of Application

This Policy sets out the end-to-end management requirements for the receipt, verification, analysis, remediation, and disclosure of security vulnerabilities discovered by external parties in the information systems, self-developed software and hardware products, externally provided cloud services, and collaboratively deployed devices of [Qingdao Wintec System Co., Ltd.] (hereinafter referred to as "the Company"), and defines the rights, obligations, and operational standards of the Company and vulnerability disclosers.

This Policy applies to all external individuals, research institutions, security vendors, and other entities (hereinafter referred to as "Disclosers") that disclose security vulnerabilities to the Company, and also binds all internal departments and personnel of the Company involved in vulnerability handling.

The assets covered by this Policy include: the Company's self-developed software and hardware products (including firmware, clients, and server-side components), internal business information systems, externally provided cloud services, and collaboratively deployed software and hardware devices together with their supporting systems.

II. Normative References

This Policy strictly follows the core requirements of ISO/IEC 29147:2018 (Information technology — Security techniques — Vulnerability disclosure) and EN 40000-1-3, and complies with national laws and regulations such as the Cybersecurity Law of the People's Republic of China, the Data Security Law of the People's Republic of China, and the Personal Information Protection Law of the People's Republic of China, as well as relevant industry security standards.

III. Vulnerability Receipt Channels

This Policy provides one or more of the following contact mechanisms for receiving vulnerability reports and inquiries related to the coordinated vulnerability program. All secure receipt channels use HTTPS and encrypted email for transmission and confidentiality:

1. Dedicated vulnerability report email: winteccra@wintec.cn

2. Contact phone: 400-7089898

3. Web vulnerability report form: https://www.wintec.cn/report.html

All contact mechanisms are accessible through multiple channels, ensuring that individuals with disabilities (e.g., writing impairments) can still submit reports and make inquiries normally.

IV. Discloser Submission Requirements

To enable the Company to verify vulnerabilities quickly and accurately, Disclosers submitting vulnerability reports through official channels must provide true, complete, and valid information. The specific requirements are as follows:

1. Entity information: the Discloser's name / organization name, valid contact details (email, phone), and affiliated organization (if any), so that the Company can communicate and coordinate normally; for anonymous disclosure, at least one contact method capable of receiving feedback must be provided.

2. Asset information: the exact name, model, version number, and deployment environment of the affected Company product / system / device, as well as the specific functional module and access path where the vulnerability exists.

3. Vulnerability information: the vulnerability type (e.g., remote code execution, SQL injection, privilege escalation, etc.), trigger conditions, and detailed reproducible steps; if a network attack is involved, the required network environment and privilege level must be described.

4. Verification materials: screenshots, tools, data packets, system logs, and simple proof-of-concept (POC) code that can prove the existence of the vulnerability (submitting destructive exploitation tools or malicious code is prohibited), together with verification results of the potential harm that could be caused if the vulnerability is exploited.

5. Additional notes: the time the vulnerability was discovered, whether it has been disclosed to any third party, whether any self-remediation suggestions exist, and any other supplementary information related to the vulnerability.

6. Submission commitment: the Discloser must explicitly undertake in the report that the submitted information is true and valid, that no attack has been conducted using the vulnerability, and that no vulnerability details will be disclosed to any third party before the Company completes the remediation.

V. Company Vulnerability Handling Process

The Company executes a standardized, closed-loop handling process for vulnerability reports submitted by Disclosers, with time limits for each stage set strictly in accordance with ISO/IEC 29147:2018, EN 40000-1-3, and CRA requirements. The process is as follows:

1. The Security Management Department monitors vulnerability reports from official channels 24/7 and performs an initial triage immediately upon receipt to confirm whether the report constitutes a valid vulnerability report;

2. For a valid vulnerability report, an acknowledgment receipt is sent to the Discloser within 2 business days, specifying the point of contact, contact details, and subsequent handling process; for an invalid vulnerability report, the reason for rejection is provided and the handling process is terminated. Invalid vulnerability reports include the following:

• The vulnerability cannot be reproduced and no further valid information can be obtained;

• The report is a duplicate submission;

• The vulnerability exists in a discontinued or no-longer-supported product;

• The issue is not a security vulnerability or is not currently exploitable;

• Other invalid cases.

VI. Confidentiality Period at the Receipt Stage

1. During the vulnerability receipt and acceptance stage, the confidentiality period is assessed and determined based on the risk level, impact scope, and remediation difficulty of the vulnerability: by default, 90 days for high-risk, 60 days for medium-risk, and 30 days for low-risk vulnerabilities;

2. During the confidentiality period, vulnerability information is strictly controlled and early external disclosure is prohibited.

VII. Public Vulnerability Disclosure Rules

The Company follows the public disclosure requirements set out in ISO/IEC 29147:2018 and, taking into account the remediation status and business impact, conducts graded and well-timed public disclosure, ensuring that the disclosure both protects users' right to know and avoids secondary risks caused by the leakage of vulnerability details.

1. Disclosing Entity

The Company is the sole entity authorized to publicly disclose vulnerabilities; no other department or individual may disclose any vulnerability information to external parties without authorization.

2. Disclosure Timing and Time Limits

• Regular disclosure: after the vulnerability is remediated and verified, the Company publishes an official remediation advisory through official channels within 3 business days, disclosing the relevant vulnerability information and remediation plan;

• Emergency disclosure: if the vulnerability is illegally leaked by a third party, poses a risk of large-scale malicious exploitation, or must be disclosed early due to industry regulatory or legal requirements, the Company publishes a vulnerability early-warning advisory within 24 hours after taking necessary interim protective measures, informing users of the risk and interim protection methods, and subsequently issues a complete remediation advisory once the vulnerability is fixed;

• Delayed disclosure: if the remediation involves the Company's core business systems and direct disclosure could trigger major business risks, disclosure may be appropriately delayed after approval by the person responsible for information security and with the Discloser's understanding; however, the delay may not exceed 7 business days after remediation is completed, and disclosure progress must be continuously shared with the Discloser.

3. Disclosure Content and Channels

• In strict accordance with ISO/IEC 29147:2018 and EN 40000-1-3, only necessary vulnerability information is disclosed, excluding sensitive content such as exploitation details, core code, and POC files.

4. Post-Disclosure Follow-up

• The Company maintains a user feedback log, promptly addresses users' inquiries about vulnerability remediation, assists users in completing the remediation, and tracks the remediation status in a timely manner. If the vulnerability is found to be reproducible or exploited in new ways, the emergency response procedure is activated immediately and an updated advisory is published promptly.

VIII. Breach Handling

If a Discloser violates the obligations stipulated in this Policy and engages in any of the following acts, the Company will immediately terminate communication with such Discloser and reserves the right to pursue civil, administrative, and criminal liability; where losses are caused to the Company and its users as a result, the Company will demand compensation in accordance with the law:

1. Deliberately submitting false vulnerability information that disrupts the Company's normal security operations;

2. Disclosing a vulnerability through a channel other than the Company's official channel, or leaking vulnerability details to third parties or the public before the Company completes remediation;

3. Exploiting the disclosed vulnerability to launch attacks, steal Company or user data, disrupt the normal operation of information systems, or commit other unlawful acts;

4. Leaking internal sensitive information provided by the Company during vulnerability handling;

5. Demanding money or property from the Company, making unreasonable demands, or using threats or coercion to interfere with the handling process under the pretext of vulnerability disclosure;

6. Violating other obligations under this Policy and refusing to rectify after being reminded by the Company.