TB888通宝

Document Owner：Rockchip Product Security Incident Response Team (PSIRT)

Version: V1.1.0

Published Date: 2026/8/17

Public Location:

/a/en/Security

/.well-known/security.txt 

Classification: Public

1. Scope of Responsibilities

Rockchip Product Security Incident Response Team (PSIRT) is responsible for receiving, investigating, and disclosing the security vulnerability information related to Rockchip products and solutions. We encourage that professional researchers, organizations, government agencies, and vendors report relevant security vulnerabilities to Rockchip PSIRT

Policy scope

· Security incidents in hardware or software of Rockchip products 

· Defects in safety information or recommendations in Rockchip documents, e.g., datasheets and application notes

· Security-sensitive documents or security-related information found in places where they should not be provided 

· Security-sensitive Rockchip products found in places where they should not be provided

Out of scope 

· Vulnerabilities in Rockchip IT systems, such as the website. Still, you can send the relevant information to PSIRT, which will be forwarded to the appropriate Rockchip teams. 

· Any other supports or events. E-mails regarding product support and other unrelated topics will not be responded by PSIRT.

· Third-party services we do not operate 

· Findings that are already public 

· Reports with no demonstrable security impact 

· Volumetric denial-of-service testing 

· Social engineering of our staff or customers 

2. Process

Rockchip PSIRT Process

a) Detect vulnerabilities

To timely process security vulnerabilities, we must detect them in the first place. On the one hand, Rockchip encourages security researchers, organizations, customers, and vendors to report potential vulnerabilities to Rockchip PSIRT in a timely manner. On the other hand, Rockchip keeps monitoring well-known public vulnerability repositories, open-source communities, and security websites to detect vulnerabilities related to Rockchip products. When a potential vulnerability is reported to Rockchip PSIRT, PSIRT confirms the receipt of the report and notifies the appropriate technical team to analyze the vulnerability.

b) Analyze vulnerabilities

For any potential vulnerabilities reported to Rockchip PSIRT, the technical team analyzes them as soon as possible and confirm the validity and influence of the vulnerabilities; Rockchip uses the most popular Common Vulnerability Scoring System (CVSS) to analyze the severity of vulnerabilities.

c) Define solutions

Vulnerability severity levels are assessed based on the actual impact to determine the priorities according to which solutions are provided. Rockchip develops patches or updates software versions for the affected products, and conduct sufficient tests to ensure the effectiveness.

d) Release solutions

Rockchip releases the patches or software versions to customers, and notifies customers in the Security Advisory (SA) or software release notes, so that customers make risk policies accordingly.

e) Optimize solutions

Rockchip collects feedbacks from customers and optimizes the solutions when necessary. We will also continue to improve the vulnerability handling process.

3. How to Report

Potential security vulnerabilities can be reported by email: [psirt@rock-chips.com](mailto:psirt@rock-chips.com), or by telephone with 400-7700-590 for China mainland, 0086-591-83991906 Ext:8198 for oversea.

Since vulnerability information is relatively sensitive, we strongly recommend that you use our [PGP Key](/uploads/240514/Rockchip_PSIRT_0xB12ADB4F_public.asc) when reporting security vulnerabilities to Rockchip PSIRT.

Secure and anonymous reporting

To protect sensitive vulnerability information while it is being exchanged:

· Our web form is served over HTTPS.

· You may encrypt email to us using our PGP key (fingerprint: 55B7 E7AE E8B8 D1DB 1ED2 7EB2 E180 A02D B12A DB4F), available from /uploads/240514/Rockchip_PSIRT_0xB12ADB4F_public.asc.

· You may report anonymously. If you would like a response, please give us a contact address or an alias.

· We will still accept reports sent through less secure channels — please do not let the lack of encryption stop you from reporting.

What to include in your report: 

To help us validate and fix the issue quickly, please include as much of the following as you can:

· Product identification — the affected product or service name, the affected version(s), and the platform or environment (OS, hardware) where applicable.

· Vulnerability description — what the issue is and where it exists, and its type or class (e.g., buffer overflow, SQL injection, improper authentication).

· Impact — the potential impact if the issue is exploited (confidentiality, integrity or availability), and a severity assessment or CVSS score if you have one.

· Reproduction steps — step-by-step instructions to reproduce the issue, and proof-of-concept code or technical evidence if available.

· Discovery information — the date you found the issue and how (testing method, tool, or accidental finding).

· Your contact information — your name or alias (you may remain anonymous) and a channel for follow-up.

· Disclosure intent — whether you intend to publish your findings, and any date you are working toward.

4.  Policies

We are committed to providing safe, reliable, and innovative products for customers. In order to maximize the efficiency of analyzing, resolving, and disclosing security vulnerabilities, we urge you to comply with the following policies when you submit vulnerability reports.

 Disclosure Policies

· Security vulnerabilities must be related to defects in hardware or software of Rockchip products or in Rockchip documents regarding security information or recommendations (e.g., datasheets and application notes).

· Security issues are yet unknown to Rockchip and are only reported to Rockchip.

· All security information must be kept confidential before being disclosed. Limit access to non-public vulnerability information in accordance with the "need-to-know" principle.

· Invasion of privacy, disruption of the product ecology, and destruction or tampering of data are not allowed.

· When different persons submit the same security issue, only the first one is listed in our security acknowledgement.

· Security vulnerability submissions may be additionally restricted by applicable laws.

· Your tests should not violate any laws, nor destroy or affect any data that does not belong to you. This policy is consistent with the general vulnerability disclosure practices. Any activities that violate laws or may result in the breach of legal obligations are not allowed.

· Rockchip reserves the right to determine the eligibility of submissions.

What you can expect from usAfter you submit a report, we will:

   acknowledge receipt within 3 business days and assign a tracking reference;

   aim to triage and validate your report within 14 business days, and contact you if we need more information;

   keep you informed of our progress at reasonable intervals (at least every 14 days);

   aim to deliver a resolution within 90 calendar days, depending on complexity and any third parties involved;

   notify you when the vulnerability has been remediated, and may invite you to confirm that the fix resolves it.

Coordinated disclosure

We follow a coordinated disclosure approach:

· We ask that you give us a reasonable opportunity to remediate the issue before disclosing it publicly.

· We will not publicly disclose details of a reported vulnerability before it has been addressed; any public disclosure will be coordinated and agreed between you and us.

· Where appropriate we agree an embargo period. Embargo timelines can be adjusted case by case by mutual agreement, including where a coordinator or other vendors are involved.

· When a fix is released, we publish a security advisory and, where appropriate, request a CVE identifier as an international standard identifier.

Where to find our security advisories?

When a vulnerability has been remediated, we publish a security advisory so that users can assess whether they are affected and how to update. You can find our advisories at: /a/en/Security/advisories.

Confidentiality and recognition

· We treat vulnerability reports as confidential. We will not share the personal information you provide with third parties without your explicit consent, except where required by law.

· With your permission, we are happy to credit you for your discovery in our advisory or on our acknowledgements page. Let us know if you would prefer to remain anonymous.

Safe harbour and good-faith research

If you make a good-faith effort to comply with this policy during your research, we will consider your research authorized, we will work with you to understand and resolve the issue quickly, and we will not pursue or support legal action against you.

Good-faith research means, among other things, that you: 

· only interact with systems or accounts you own or have explicit permission to test;

· avoid privacy violations, destruction of data, and any degradation of our services (for example, no denial-of-service testing);

· access only the minimum data necessary to demonstrate the issue, and do not store, share or use it;

· give us a reasonable time to resolve the issue before any disclosure.

Note: Rockchip does not sell chips directly to end-users. Rockchip only sells chips to manufacturers and provides SDKs and materials to them, and the manufacturers develop the code provided by Rockchip based on their own requirements. Therefore, Rockchip does not provide technical support for end-users. If you have problems using Rockchip products, please contact the manufacturers for technical support. We would like to thank the individuals and teams who report valid vulnerabilities and work with us in responsible disclosure.

[Thanks] will be given to the individuals and teams who report valid security vulnerabilities and cooperate with us during disclosure.

Policy changes

We may update this policy from time to time. The current version and its publication date are shown in Document control above; material changes are recorded below.

PGP KEY

· Rockchip public [PGP Key](/uploads/240514/Rockchip_PSIRT_0xB12ADB4F_public.asc) for communication.

· Because vulnerability information is relatively sensitive, we strongly recommend that you use our PGP public key (key ID: B12ADB4F; PGP fingerprint: 55B7 E7AE E8B8 D1DB 1ED2 7EB2 E180 A02D B12A DB4F) for encryption when reporting potential security vulnerabilities to Rockchip PSIRT.

· You can also copy the following PGP Key: [Rockchip public PGP Key](/uploads/240514/Rockchip_PSIRT_0xB12ADB4F_public.asc)