1. Information Security Policy Description

This policy aims to establish a complete process for effectively managing operations from the discovery of product vulnerabilities to the final remediation, ensuring the security of our products, systems, operations, and data. In the current environment, with the rapid development of technology, the risk of security vulnerabilities is increasing, which necessitates a clear and efficient response mechanism.

This policy applies to the company’s products or systems, covering all stages including design, manufacturing, and sales, ensuring timely detection and handling of any security vulnerabilities throughout the entire product lifecycle. Vulnerabilities are defined as defects or shortcomings that occur during the product process, which may cause harm to consumers or users and affect the product’s performance, quality, or safety standards.

To ensure effective vulnerability management, product managers, R&D, and quality assurance departments must immediately initiate remediation, validation, and monitoring activities upon receiving vulnerability notifications. Additionally, the procurement department must require suppliers to provide declarations before purchasing, in order to reduce potential security risks.

We encourage both internal and external personnel and users to responsibly report any security vulnerabilities. By submitting the vulnerability reporting form provided in Section 3, reporters can submit detailed information about the vulnerabilities. During this process, reporters must comply with legal regulations and refrain from disclosing specific details until the vulnerabilities are resolved, to avoid further security threats.

Once a vulnerability report is received, the relevant departments will assess and verify it, including identifying the type of vulnerability, its impact, and validating its authenticity. Subsequently, based on risk prioritisation, remediation or corrective actions will be undertaken. After remediation, validation testing must be conducted to ensure the fix is successful and does not introduce new issues.

Once the remediation is completed, internal notifications and necessary external announcements will ensure that all relevant parties are informed. Additionally, ongoing monitoring and improvement efforts will continue to summarise experiences and prevent similar issues from occurring again.

Through this series of processes, we are committed to protecting the security of our products and users, ensuring the company’s long-term stable operation.

2. Information Security Reports

Currently, there are no information security reports.

• 2.1 Known Third-Party Vulnerabilities: None
• 2.2 Security Updates and Patches: None
• 2.3 Firmware Updates and Patches: None

3. Vulnerability Reporting Form

4. Reporting Contact