Please use this page to report potential security vulnerabilities in products and software. See the following guidelines for more information on vulnerability disclosure.
Vulnerability Disclosure Policy
As a manufacturer of technologically advanced electronic lighting components and software, security is core to Shenzhen Cupower Co., Ltd (“Cupower”) values.Therefore, Cupower is committed to ensuring the security of users of Cupower products and software by protecting their privacy and information. Since Cupower values the input of external security researchers acting in good faith to help Cupower maintain a high standard for the security privacy of our users and systems, this policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us.We strongly encourage you to contact us to report potential vulnerabilities in products and software.
Authorization
If you make a good faith effort to comply with this policy during your security research, Cupower will treat this responsibly, and work with the reporter of the vulnerability to understand the issue to eventually resolve the issue.
Guidelines
Under this policy, “research” means activities in which you:
Notify us as soon as possible after you discover any real or potential security issue.
Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
Only use exploits to the extent necessary to confirm a vulnerability’s presence. Do not use an exploit to compromise or exfiltrate data, establish persistent command line access, or use the exploit to pivot to other systems.
Once you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), you must stop your test, notify us immediately, and not disclose this data to anyone else.
Scope
This policy applies to the following systems and services:Cupower branded products, associated firmware and product related software.
Reporting a vulnerability
Information submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly discovered vulnerabilities that affect all users of a product or service and not solely Cupower, we may share your report with information with concerned parties such as suppliers, cooperation partners, distributors, customers without express permission.
We recommend using the form below, but we also accept vulnerability reports via email to sales@Cupower.com.
Reports may be submitted anonymously.
Reporting Rules
In order to help us triage and prioritize submissions, we recommend that your reports:
Is in English, if possible
Contain a description of the issue
Names the article number of the product in question
Names manufacturing date (if applicable)
Names software version (if applicable)
Contains a description of the location the vulnerability was discovered and the potential impact of the exploitation
Contains detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful)
What you can expect from us / response times
When you choose to share your contact information with us, we commit to coordinating with you as openly and as quickly as possible.
Within 5 business days excluding Saturdays, we will acknowledge that your report has been received.
We will maintain an open dialogue to discuss issues.