Trust
How to report a vulnerability, how we handle reports, how we protect client material, and how to check who we are.
Report a vulnerability
If you find a vulnerability in a chip we designed or on this website, or want to report misuse of ChipFans’ name or work, email our security contact. We will keep you informed as we work on a fix, and agree a disclosure date with you.
chipfans.com/.well-known/security.txt
- Contact
- mailto:security@chipfans.com
- Expires
- 2027-04-10T
00:00:00.000Z - Policy
- https://chipfans.com/
trust #disclosure - Canonical
- https://chipfans.com/
.well-known/ security.txt - Preferred-Languages
- en
What to include in a report
- What is affected: a URL on this website, or a chip and the product it is in
- What the issue is, and its likely impact
- How to reproduce it, and any evidence you have
- How to reach you, and the name you would like credited, if any
- Whether you plan to publish, and when
To report misuse of ChipFans’ name or work, tell us what was done, where and when, and include any messages or links.
Coordinated disclosure policy
When you report a vulnerability to us:
- We acknowledge your report within 5 business days.
- We keep you informed as we work on a fix.
- We agree a disclosure date with you.
- We credit you when the issue is disclosed, if you wish.
Scope
You can report a vulnerability in this website or in any chip we designed. If the chip is in a client’s product, we involve that client and agree the disclosure date with you and with them.
The safe harbor below covers testing of this website and of ChipFans’ own products only. This policy is not an invitation to test our clients’ systems, or any other system that is not ours.
Safe harbor
If you act in good faith, test only this website or ChipFans’ own products, and follow this policy, we will not take legal action against you over your research. We can make this promise only for ChipFans: it does not cover anyone else’s systems or rights.
What we ask of you
- Report the issue to us first, and keep it confidential until the agreed disclosure date.
- Access only what you need to show the issue, and do not change or delete data that is not yours.
- Do not disrupt this website or anyone’s use of it.
- If you are unsure whether something is in scope, ask us before you test it.
Protecting client material
- We keep your samples, firmware and data confidential.
- We store them with access limited to whoever works on your evaluation, and use AI-assisted analysis tools on them only if you have agreed to it in writing.
- We return or destroy them within 30 days of close-out.
Verify who we are
- Registered legal name
- ChipFans Technology Co., Ltd.
A company registered in Taiwan. You can look us up in the public business register.