1. We prioritise information security vulnerability management in product development and maintenance.
2. We take measures to reduce or eliminate harm to customers caused by information security vulnerabilities in our products and services, and ensure compliance.
3. When vulnerabilities are discovered in our products and services, we promptly provide risk mitigation measures to customers and users.
4. We proactively identify vulnerability management responsibilities and requirements – including applicable laws and regulations, contractual obligations and public standards for business operations – to establish a mechanism for proactive vulnerability management.
5. We will continuously optimise our vulnerability management processes and standards, drawing on industry standards and best practices, to improve vulnerability management maturity.

1. Jinko ESS has a vulnerability disclosure and handling process, and encourages security researchers, industry organisations, customers and suppliers to report suspected vulnerabilities in Jinko ESS products to the Jinko ESS PSIRT. If you discover a vulnerability, please email the details to psirt_jinkoess.com (replace "_" with "@" when sending). The report should include a description, product model, software version and your contact information. We will analyse and respond to your report as soon as possible.
2. Typically, we will send an acknowledgement within 1 working day of submission, and complete verification and provide feedback within 7 working days. We will keep you updated on progress throughout the handling process.
3. During the entire process, Jinko ESS PSIRT will strictly limit the disclosure of vulnerability information to personnel directly involved in handling it. We also ask that reporters keep the vulnerability confidential until our customers have received a full solution. We will take necessary and reasonable measures to protect the data we collect, in accordance with legal and compliance requirements. Unless required by law or affected customers, we will not proactively share or disclose the above data to other parties.

1. Upon receiving any suspected information security vulnerability, the Jinko ESS PSIRT will collaborate with relevant product teams to analyse/verify the vulnerability, assess its severity based on its actual impact on the product, determine its remediation priority, and develop remediation measures (including mitigation measures, patches/versions, and other risk mitigation measures that customers can implement).
2. During product development, delivery and deployment, if vulnerabilities are found in products or services provided by suppliers, we will proactively contact the supplier for vulnerability remediation.

Jinko ESS discloses vulnerability information and remediation solutions externally through the following means:

Security Advisory:

The Security Advisory contains information such as vulnerability severity levels, business impact and remediation solutions, and is used to communicate vulnerability fix plans. The Security Advisory is used to publish vulnerability information and remediation solutions for vulnerabilities of Critical and High severity that are directly related to Jinko ESS products, so that customers can be informed of the vulnerability information and assess risks.