Security Vulnerability

In addition to establishing a product security management framework to ensure the delivery of secure and reliable products, Phison is dedicated to minimizing cybersecurity risks associated with them to the greatest extent possible. 

Thank you for reporting security-related issues to Phison. Your report helps us improve product security, and we appreciate your responsible disclosure.

We are committed to handling every report with transparency, respect, and promptness.

Recommended Information to Include in Your Report

To help Phison evaluate your submission as quickly as possible, it is recommended that you provide the following information:

• Detailed information about Phison products, including product name, part number, hardware/software version.
• How and when the potential vulnerability was discovered, and by whom
• Technical description of the vulnerability, including any related (1) known exploits and (2) existing CVE ID(s)
• Your contact information, so that Phison is able to ask any necessary follow-up questions

Due to their sensitive nature, Please use our PGP Public Key to send the encrypted security report to:[email protected]

Our Handle Flow Summary

1. Acknowledgment: Phison will send a confirmation email of receiving your report.
2. Initial Assessment: Our security team will evaluate the impact and priority.
3. Fix & Verification: If valid, we will arrange for patching, internal testing, and external verification. Multiple rounds of communication may occur.
4. Disclosure (if applicable): After mitigation, Phison may publish an advisory, CVE ID, and technical details per our responsible disclosure policy.

Responsible Disclosure & Safe-Harbor Statement

To encourage responsible disclosure, we commit not to pursue legal action or notify law enforcement against reporters who follow these principles (unless other illegal activities are involved):

1. Only test systems and resources you are authorized to access.
2. Avoid unnecessary disruption or data damage to production systems.
3. Collect only minimal data necessary for reproduction; avoid downloading sensitive user data.
4. Do not publicly disclose vulnerability details or PoC (proof-of-concept) before remediation, unless mutually agreed.
5. Cease testing immediately if requested by us.

This Safe-Harbor does not apply to malicious behavior or criminal activities such as fraud, extortion, or data theft.