Report vulnerabilities as the rules require, and before they are fixed don't publish the details, release exploit tools or hand them to anyone abroad

Cost

Free. Report the vulnerability to the product provider, or to an official platform. Until the vendor has fixed it, don't publish the details and don't publish verification code.

What you get

The provisions cover three kinds of subjects: network product providers in China, network operators, and organizations or individuals engaged in finding, collecting or releasing vulnerabilities. No organization or individual may use vulnerabilities to endanger network security, or illegally collect, sell or release vulnerability information. Releasing vulnerability information to the public must follow five rules. First, it may not be released before the product provider has provided a fix. Second, the details of vulnerabilities in networks, information systems and equipment in use by network operators may not be released. Third, the harm and risk may not be deliberately exaggerated, and vulnerability information may not be used for malicious hype or fraud. Fourth, programs and tools made specifically to exploit vulnerabilities to endanger network security may not be released or provided. Fifth, a fix or protective measure must be released at the same time. In addition, vulnerability information that has not been made public may not be given to any organization or individual abroad other than the product provider. The provisions encourage reporting vulnerabilities to four official platforms. The first is the Ministry of Industry and Information Technology (工业和信息化部) network security threat and vulnerability information sharing platform. The second is the vulnerability platform of the National Cyberspace Information Security Notification Center (国家网络与信息安全信息通报中心). The third is the vulnerability platform of the National Computer Network Emergency Response Technical Team/Coordination Center (国家计算机网络应急技术处理协调中心). The fourth is the vulnerability database of the China Information Technology Security Evaluation Center (中国信息安全测评中心). Those who collect or release vulnerability information in violation of the provisions are dealt with according to law by the Ministry of Industry and Information Technology and the Ministry of Public Security within their own duties. If the conduct falls under the Cybersecurity Law, it is punished under that law. Releasing network security information such as system vulnerabilities to the public must follow national rules. For violations, the competent authority orders correction and gives a warning, and may fine 10,000 to 100,000 CNY. For refusing to correct, or in serious cases, the fine is 100,000 to 1,000,000 CNY. It can also order the business suspended, order a shutdown for rectification, or close the website or app. It can also revoke the relevant business license or the business registration. The directly responsible managers and other directly responsible personnel are fined 10,000 to 100,000 CNY (nationwide)

Notes

The provisions name individuals as covered subjects, and "I am only a hobbyist" is not one of the exceptions. Submitting a hole in a Chinese system to a bug bounty platform abroad falls squarely under the rule that "vulnerabilities not made public may not be given to anyone abroad." Whether you were entitled to test is covered in §11.9 (don't test other people's systems without written authorization), and it should be judged separately from what you do with the vulnerability afterward. A vulnerability found lawfully can still lead to a fine if it is released in a way that breaks the rules. A vulnerability found by unauthorized testing has a problem at both ends, the testing and the release. Among the reporting channels, the Ministry of Industry and Information Technology platform and the National Internet Emergency Center (CNCERT, 国家互联网应急中心) are the most used. The provisions do not separately address the case where "the vendor has been told but does not fix it." In practice, keep a record of the discussion and reporting, and report to an official platform at the same time.

Evidence grade

A : Specific numbers from meta-analyses, large cohorts or randomized trials; for law and policy, the statute or official text.

Sources

1. 工业和信息化部、国家互联网信息办公室、公安部 (2021). 网络产品安全漏洞管理规定（工信部联网安〔2021〕66 号，第二、四、九、十、十四条，2021 年 9 月 1 日施行）. https://www.gov.cn/gongbao/content/2021/content_5641351.htm
2. 全国人大常委会 (2025). 网络安全法（2025 年修正，2026 年 1 月 1 日施行，第二十八、六十五条；2016 年文本为第二十六、六十二条，规定第十四条援引的是 2016 年文本的条号）. https://www.cac.gov.cn/2025-12/29/c_1768735112911946.htm

Translated from the Chinese original. Original book, section 11, tip 10. This section describes legal rules, mostly mainland China’s. It is general information, not legal advice; for your own case, talk to a lawyer. Content may be out of date and rules differ by place. When you actually deal with an agency, a doctor or a court, follow what local officials, doctors and lawyers tell you. Disclaimer