Report vulnerabilities as required; before a patch, do not publish details, release exploit tools, or hand them to parties abroad

Individuals are also covered by the (网络产品安全漏洞管理规定). Before the vendor has a fix, you must not publish the vulnerability, and must not publish vulnerability details for systems currently in use. You must not release programs and tools made to exploit the vulnerability, and when you publish you must also explain how to fix it. Unpublished vulnerabilities must not be given to organizations or individuals abroad other than the vendor

Cost

No money spent. Report the vulnerability to the product provider, or to an official platform. Until the vendor has fixed it, do not publish details or proof-of-concept code

Benefit

This regulation covers three kinds of subjects: domestic network product providers, network operators, and organizations or individuals engaged in discovering, collecting, publishing, and similar activities involving vulnerabilities. No organization or individual may use vulnerabilities for activities that harm cybersecurity, or illegally collect, sell, or publish vulnerability information. Publishing vulnerability information to the public must follow five rules. First, do not publish before the product provider offers a remediation measure. Second, do not publish details of vulnerabilities in networks, information systems, and equipment currently used by network operators. Third, do not deliberately exaggerate harm and risk, and do not use vulnerability information for malicious hype or fraud. Fourth, do not publish or provide programs and tools specially used to exploit vulnerabilities for activities that harm cybersecurity. Fifth, when publishing, publish remediation or prevention measures at the same time. Also, unpublished vulnerability information must not be provided to organizations or individuals abroad other than the product provider. The regulation encourages reporting vulnerabilities to four official platforms. One is the MIIT cybersecurity threat and vulnerability information sharing platform. Two is the National Cyber and Information Security Information Notification Center vulnerability platform. Three is the CNCERT/CC vulnerability platform. Four is the China Information Technology Security Evaluation Center vulnerability database. Collecting or publishing vulnerability information in violation is handled by MIIT and the Ministry of Public Security according to their duties. Conduct that meets circumstances under the (网络安全法) is punished under that law. Publishing system vulnerabilities and other cybersecurity information to the public shall comply with relevant state rules. Violations bring orders to correct and warnings from the competent authority, and may bring a fine of 10000 yuan or more and 100000 yuan or less. Refusal to correct or serious circumstances bring a fine of 100000 yuan or more and 1000000 yuan or less. The authority may also order suspension of related business, shutdown for rectification, or closure of the website or application. It may also revoke related business permits or the business license. Persons directly in charge and other persons directly responsible may be fined 10000 yuan or more and 100000 yuan or less (nationwide)

Notes

The regulation expressly includes individuals among those covered; “I’m only an amateur” is not an exception. Submitting a bug in a domestic system to a foreign bug-bounty platform falls squarely under “unpublished vulnerabilities must not be provided abroad.” Whether you are allowed to test is in item 9 (do not test others’ systems without written authorization); that is separate from how you handle a vulnerability once you have it. A lawfully found vulnerability can still draw a penalty for unlawful publication; a vulnerability found without authorization has problems on both the testing and the publishing sides. The regulation does not specially address “the vendor was notified but does not fix.” The author’s advice is to keep records of negotiation and reporting, and also report to the four official platforms above.

Sources · 2

1. 工业和信息化部、国家互联网信息办公室、公安部 (2021). 网络产品安全漏洞管理规定（工信部联网安〔2021〕66 号，第二、四、九、十、十四条，2021 年 9 月 1 日施行）. gov.cn/gongbao/content/2021/content_5641351.htm
2. 全国人大常委会 (2025). 网络安全法（2025 年修正，2026 年 1 月 1 日施行，第二十八、六十五条；2016 年文本为第二十六、六十二条，规定第十四条援引的是 2016 年文本的条号）. cac.gov.cn/2025-12/29/c_1768735112911946.htm