sanag 安全响应中心（SSRC）漏洞披露计划

sanag highly values the security of its products and services, and is committed to developing secure and reliable products and ensuring user privacy protection. In the meantime, we’ve realized that security researchers play an important role in protecting sanag’s products and consumers, which is why the SSRC (sanag Security Response Center) Vulnerability Disclosure Program (hereinafter referred to as the Program) is developed. The Program provides a secure channel for researchers to report security issues of the Company and offers effective measures to triage and mitigate the security vulnerabilities. We are truly grateful to the researchers who followed the practice of responsible disclosure and did not disclose the vulnerabilities prematurely during the time required for issue resolution. Premature public disclosure of the vulnerabilities will put sanag users at higher risks. If you have identified any security vulnerabilities or issues in any domain names or products that belong to or relate to sanag, you are advised to report the vulnerabilities via SSRC official website or send your vulnerability report to email: service@sanag.cn.

To protect our users, sanag will not disclose, discuss or confirm any security issues before a full investigation is completed with available updates.

Before you get into the details of the Program, please take a close look at the policies, terms, and conditions of the Program. If you disagree with the policies or terms of this program, you can exit the program and we will stop providing relevant services. If you continue to stay in the program, it means you fully understand and accept the following policies and terms.

(1) Responsible Disclosure – Policy

When reporting a security vulnerability to sanag, we ask that:

• You give us reasonable time to investigate and mitigate an issue you report before making any information contained in the report public or information shared with third parties.
• You do not exploit a security issue you discover for any reason. This includes demonstrating additional risk, such as attempts to compromise sensitive company data or probing for additional issues.
• You do not intentionally violate any other applicable laws or regulations.
• You do not violate any privacy rules, privacy regulations, or cause disruptions to others including, but not limited to unauthorized access to or destruction of data and interruption or degradation of our services.
• You read, agree and align with sanag Company Privacy Policy.
• You read, agree and adhere to our Responsible Disclosure Terms & Conditions.

(2) Responsible Disclosure – Terms & Conditions

If you inadvertently or intentionally access sanag and its affiliates’ proprietary customer, employee, or business related information during your testing, the information must not be used, disclosed, stored, or recorded in any way. Access to any such data must be declared as part of your vulnerability report.

By submitting information about a potential security vulnerability, you are granting sanag a worldwide, permanent, royalty-free, non-exclusive license to use your submission for the purpose of addressing security vulnerabilities in sanag or its affiliates’ products and services. We will respond to your report on SSRC or via email, acknowledging receipt and updating you on our progress within 30 working days. Also we will continue to follow up on the issue until it is resolved. You can check the latest status of the vulnerability reports you submitted by logging into the official SSRC website. This allows you to keep track of the progress until we complete the fixes and close the vulnerability report.

By submitting a security vulnerability report, you affirm that you have not previously disclosed the security vulnerability to anyone other than sanag. Absent sanag’s prior written consent, any disclosure outside of this process would be a violation of the terms & conditions of the Program.

(3) Product Security Update Period

sanag prioritizes the security of its products and services as a fundamental aspect of our commitment to our users. To uphold this commitment, we diligently provide timely updates to system security patches. These updates are essential to safeguard the information of every device and user, ensuring a secure experience for all. For our earbud/headset products, we pledge to provide security updates for a minimum of one (1) year following the product launch.

Users may submit vulnerability reports on sanag Security Response Center (SSRC) or send emails to service@sanag.cn to report any security issues to sanag.