Enterprise Vulnerability Disclosure Policy

1. Introduction and Commitment

Our company attaches great importance to the security and privacy of our users, and is committed to promptly, carefully, and comprehensively resolving potential security vulnerabilities in our products and services. We follow the international standard practices of Coordinated Vulnerability Disclosure (CVD) and highly value the contributions of the cybersecurity research community, looking forward to ensuring the safety of end users through open communication and collaboration.

2. Policy Scope

This policy applies to all hardware, software, web applications, cloud services, and underlying infrastructure developed by our company.

Out of Scope: Vulnerabilities requiring "Physical Access" to the system to trigger, or social engineering attacks targeting our company's employees, are in most cases not included within the scope of this policy.

3. Guidelines for Researchers

We encourage well-researched reports that focus on real-world security threats. During your security testing and reporting process, we require you to strictly adhere to the following guidelines:

• Avoid Harm: Make every effort to avoid violating user privacy, degrading user experience, disrupting the operation of internal or external servers, and destroying any data or physical assets.
• Strict Confidentiality: Please keep the details of identified potential vulnerabilities confidential until we release a patch or until the mutually agreed disclosure date arrives (Embargo period).
• No Commercial Use: Strictly prohibit the application of any vulnerabilities or exploit programs (Exploits) for commercial or for-profit purposes.
• Legal Compliance: Please ensure compliance with all applicable laws and regulations in your jurisdiction and where our company operates.
• You are required to cooperate with any requests by BENQ for additional information, assistance, research, and you agree to coordinate disclosures of any vulnerability as noted herein. If no response is received from you within [30] calendar days of our last inquiry, BENQ reserves the right to close the case.

4. How to Submit a Report

If you have discovered a potential security issue, please report it to our Information Security Department through the following official channel:

To help us triage and analyze the issue as efficiently as possible, please provide the following complete information in your report:

• Name of the affected product or web service, firmware/software version, or branch.
• Type of vulnerability (e.g., Cross-Site Scripting XSS, Privilege Escalation, etc.) and the date you observed it.
• Detailed instructions to duplicate the issue.
• A Proof-of-Concept (PoC) code, screenshot, or video capable of demonstrating the vulnerability.
• The potential impact of the vulnerability, including situational descriptions of how an attacker might exploit it.
• Your contact information, as well as your intention and timeline regarding public disclosure of this vulnerability.

By submitting a vulnerability report to BENQ, you grant BENQ a non-exclusive worldwide, irrevocable, perpetual, sub-licensable, fully paid-up, royalty-free license to any intellectual property contained in that report or any follow up communications related to the report to analyze, commercialize, publicize, disclose, or otherwise use such intellectual property in any manner. Except for the license granted above, you retain all rights in and to the intellectual property owned by you in the submitted materials. Participating in this process does not give you any right to any intellectual property of BENQ.

5. What to Expect from Us

After you report a vulnerability, you can expect us to take the following actions:

• Receipt Confirmation: Our security department will confirm receipt within 3 business days of receiving your submission.
• Assessment and Remediation: We will enter a standard handling lifecycle comprising: Triage, Analysis, Remediate, and Disclosure. We employ the "Common Vulnerability Scoring System (CVSS)" to objectively assess the severity of vulnerabilities. If BENQ determines that a report does not identify a vulnerability or that the reported vulnerability is a duplicate of a previously reported vulnerability, BENQ will notify you of its determination and close the case. BENQ retains sole discretion to determine the validity, severity, and priority of any reported vulnerability, and the necessity and scope of any further response or action.
• Status Updates: We will maintain collaboration and communication with you throughout the remediation process, providing progress updates based on the severity of the vulnerability and product complexity. The time required for handling, including mitigation and disclosure, may be impacted by the relative criticality of the vulnerability and other relevant factors.
• Information Fairness: To protect all customers equally, we do not provide "insider information" or advance notice to individual customers prior to the official release of patches or security advisories. We also strictly never distribute exploit code.
• If the vulnerability is expected to impact other vendors, then BENQ can engage an external coordinator to coordinate public release of advisories and facilitate collaboration among the participating entities. After such coordinated disclosure, you may further disclose or publicize their role in identifying vulnerability but may not disclose further details about their engagement with BENQ (including emails), the vulnerability, or associated exploit steps without the express prior written consent of BENQ.

6. Acknowledgments

We firmly believe that collaborating with the cybersecurity community makes our products and web services safer.

For all researchers who submit valid reports and adhere to the Coordinated Vulnerability Disclosure (CVD) guidelines, we will give public recognition and thanks in the officially published product or web service security advisories or on the "Hall of Fame" page to highlight your contributions.