Vulnerability Disclosure Policy

CHINO Corporation (hereinafter referred to as "the Company") is committed to ensuring that our customers can use our products safely and securely.
We are committed to maintaining and improving product security.
This policy outlines our approach to properly receiving, evaluating, correcting, and disclosing vulnerability information regarding our products.

1. Gathering vulnerability information

To improve the information security quality of our products, we collect information on vulnerabilities in our products from both internal and external sources.
We also welcome information from customers who use our products.
If you discover any vulnerabilities in our products, please report them using the dedicated form below.

Chino Product Vulnerability Reporting Service (Dedicated Form)

After receiving your vulnerability information, we will contact you within five business days to acknowledge receipt.
Please be aware that there may be delays in our response during long holidays such as summer and the New Year period.
For products other than those manufactured by our company, please contact the respective manufacturer.
Please note that we do not accept reports for vulnerabilities that have already been publicly disclosed.
We do not offer vulnerability bounties (bug bounties).

2. Investigation and countermeasures

Regarding the product vulnerability you reported, the design and development department of the product will promptly investigate and analyze it based on the following verification items.
We will decide on a course of action based on the results.

• Does this potentially affect the security of our products?
• Is it repeatability?
• Is this previously unreleased information?

If a new vulnerability is identified, countermeasures such as patches, upgrades, or corrected versions will be implemented to eliminate the vulnerability, depending on the nature of the vulnerability.
If we observe attacks exploiting vulnerabilities or if other urgent information needs to be provided to our customers, we will promptly inform them of available workarounds.

3. Disclosure of vulnerability information

Once we have addressed the vulnerabilities in our products, we will coordinate with the relevant organizations as needed, and schedule a meeting.
We will publish information about the vulnerability and countermeasures on our website.

Chino product vulnerability information

We ask that those who report vulnerabilities in our products refrain from disclosing information about such vulnerabilities to third parties without our permission before we make it public.

4. Revision of this policy

This policy may be changed without prior notice. The revised policy will take effect from the time it is display on this page.