TDI Coordinated Vulnerability Disclosure (CVD) Policy
How security researchers, customers, and partners can report suspected security vulnerabilities to TDI — and how we handle them.
Last Updated August 26, 2026
Owner TD Intelligence (TDI) Product Security Incident Response Team (PSIRT)
Contents
- 1. Purpose
- 2. Scope
- 3. How to Report
- 4. Information to Include
- 5. Valid Vulnerability
- 6. CVD Process
- 7. Response Times
- 8. Confidentiality
- 9. Good-Faith Research
- 10. Anonymous Reporting
- 11. Public Disclosure
- 12. Security Advisories
- 13. National CSIRT
- 14. Reporter Recognition
- 15. Out-of-Scope Activities
- 16. Data Protection
- 17. Process Closure
- 18. Contact Information
- 19. Policy Review
1.Purpose
TDI is committed to protecting the security of our products, software, firmware, development tools, and supporting services.
We recognize that security vulnerabilities may be discovered after products have been released to customers. A responsible and coordinated vulnerability disclosure process helps us investigate vulnerabilities, reduce potential risks, protect our customers, and improve the security of our products.
This Coordinated Vulnerability Disclosure (CVD) Policy defines how security researchers, customers, partners, and other external parties can report suspected security vulnerabilities to TDI and how TDI will handle such reports.
TDI encourages responsible security research and welcomes good-faith vulnerability reports.
2.Scope
This policy applies to security vulnerabilities affecting TDI products, software, firmware, development kits, SDKs, drivers, tools, and other digital products or components provided by TDI.
Examples include, but are not limited to:
- System-on-Chip (SoC) products
- Microcontrollers and processors
- Firmware and bootloader components
- Software and drivers
- SDKs and development tools
- Security-related functions and cryptographic implementations
- Product update and firmware update mechanisms
- Product-related web services and supporting infrastructure
Vulnerabilities affecting third-party products that are not developed, maintained, or controlled by TDI may be outside the scope of this policy. Such reports will be handled to the extent reasonably possible.
3.How to Report a Vulnerability
Security vulnerabilities should be reported through one of the following official channels:
For sensitive or confidential vulnerability information, reporters are encouraged to use encrypted communication with the TDI PSIRT using the published OpenPGP public key: www.Tdintelligence.com/security/pgp/psirt.asc
The corresponding key fingerprint is published on the TDI Product Security website.
TDI accepts vulnerability reports in English and Chinese.
Anonymous vulnerability reports are accepted. However, anonymous reporting may limit our ability to request additional technical information, provide status updates, or coordinate remediation with the reporter.
4.Information to Include in a Report
To help us investigate a vulnerability efficiently, please provide as much of the following information as possible:
- Product name and model
- Chip or SoC model, where applicable
- Product or firmware version
- SDK, driver, or software version, where applicable
- Affected component
- Vulnerability type
- Detailed description of the vulnerability
- Steps required to reproduce the issue
- Proof of concept (PoC), exploit code, screenshots, logs, or other supporting evidence
- Affected versions
- Suggested mitigation or remediation, if available
- Contact information for follow-up communication, unless the report is submitted anonymously
Reports containing sufficient technical information allow TDI to validate and remediate vulnerabilities more effectively.
5.What We Consider a Valid Vulnerability
A vulnerability report is generally considered valid when:
- The reported issue affects an TDI product, component, service, or infrastructure within the scope of this policy; and
- The report provides sufficient information to understand, reproduce, or further investigate the issue.
Reports should preferably concern information that is not already publicly known.
Automated scan results without supporting technical information may be insufficient for validation. TDI may request additional information where necessary.
The final determination of whether a report represents a valid security vulnerability will be made by TDI PSIRT based on the available technical evidence.
6.Coordinated Vulnerability Disclosure Process
TDI follows a coordinated vulnerability disclosure process consisting of the following general stages:
- Report ReceivedThe vulnerability report is received through an approved reporting channel.
- Initial TriageTDI PSIRT reviews the report for completeness, scope, and potential security impact.
- Validation and AnalysisThe reported vulnerability is investigated and, where possible, reproduced and technically validated.
- Risk AssessmentTDI assesses severity, exploitability, affected products and versions, and potential impact. Where appropriate, CVSS may be used as part of the assessment.
- RemediationTDI coordinates with the relevant engineering and product teams to develop a fix, mitigation, or other appropriate remediation.
- Security ValidationThe remediation is reviewed and tested to verify that the vulnerability has been appropriately addressed.
- Security Advisory and DisclosureWhere appropriate, TDI publishes a security advisory and provides affected customers or users with relevant remediation information.
- ClosureThe CVD process is completed when the vulnerability has been appropriately addressed, mitigated, or otherwise resolved in accordance with this policy.
7.Communication and Response Times
TDI is committed to maintaining timely and professional communication with vulnerability reporters.
For non-anonymous reports:
- Initial Response: TDI will provide a human response within five (5) working days after receiving the vulnerability report.
- Detailed Feedback: TDI will provide detailed feedback within ten (10) working days, including confirmation, rejection, requests for additional information, or an explanation of why further investigation is required.
Where an investigation requires additional time, TDI will provide a status update and indicate when the next update is expected.
TDI welcomes reasonable status inquiries from vulnerability reporters during the handling process.
8.Confidentiality
TDI will treat submitted vulnerability reports as confidential to the extent permitted by law and business requirements.
Personal information provided by a reporter will not be disclosed to third parties without the reporter’s explicit consent, except where disclosure is required by applicable law or regulation.
TDI asks reporters to avoid publicly disclosing vulnerability details before an agreed remediation and disclosure process has been completed.
9.Good-Faith Security Research
TDI supports good-faith security research.
Where a reporter:
- acts in accordance with this policy;
- avoids unnecessary damage to TDI systems or third-party systems;
- does not intentionally disrupt services;
- does not access, modify, delete, or exfiltrate data beyond what is reasonably necessary to demonstrate the vulnerability; and
- promptly reports the vulnerability to TDI,
TDI will treat the report as a responsible security disclosure.
TDI will not pursue legal action against a reporter solely for good-faith security research conducted in accordance with this policy, unless there is evidence of criminal intent or other conduct outside the scope of this policy.
TDI will not require a reporter to sign a non-disclosure agreement (NDA) as a prerequisite for submitting a vulnerability report.
10.Anonymous Reporting
TDI provides an anonymous reporting option through email: psirt@tdintelligence.com
Anonymous reports will be reviewed and processed to the extent reasonably possible.
Because TDI may not be able to contact an anonymous reporter, additional technical questions, clarification requests, status updates, or coordination activities may be limited.
11.Public Disclosure
TDI aims to coordinate vulnerability disclosure with the reporting party and relevant stakeholders.
Validated and verified vulnerabilities will generally be considered for public disclosure within 90 days, unless:
- the vulnerability is fixed before the affected product is placed on the market;
- additional time is reasonably required for remediation;
- disclosure could materially increase risk to customers or users; or
- a different disclosure timeline is agreed or coordinated with the relevant national CSIRT, ENISA, or other competent authority.
Where a delay is necessary, TDI will document the justification and coordinate the disclosure timeline with the relevant parties as appropriate.
12.Security Advisories
Where appropriate, TDI may publish a security advisory containing information such as:
- Vulnerability identifier
- Affected products
- Affected versions
- Severity and risk information
- Technical description
- Mitigation information
- Fixed versions
- Recommended customer actions
Security advisories may be published on the TDI Product Security website.
Where technically and operationally appropriate, machine-readable security advisories may be provided using the Common Security Advisory Framework (CSAF).
Security Advisory Portal: www.tdintelligence.com/security-tdi-sec-advisories/
13.Coordinated Communication with National CSIRT
For actively exploited vulnerabilities and other cases requiring regulatory or national cybersecurity coordination, TDI will cooperate with the corresponding national CSIRT in accordance with applicable legal and regulatory requirements.
TDI will provide relevant information, mitigation measures, remediation status, and schedules as required and will coordinate communications with the appropriate authorities.
The corresponding national CSIRT will be determined in accordance with applicable requirements for the affected product and market.
14.Reporter Recognition
With the reporter’s consent, TDI may recognize researchers who responsibly report valid security vulnerabilities.
Where appropriate, TDI may maintain a Security Researcher Acknowledgements or Hall of Fame page.
TDI may also consider additional recognition or reward programs for responsible vulnerability disclosure.
15.Out-of-Scope Activities
The following activities are generally not considered acceptable security research under this policy:
- Denial-of-service attacks or deliberate service disruption
- Social engineering or phishing attacks against employees or customers
- Spam or mass automated submissions
- Brute-force attacks against authentication systems
- Unauthorized access to, modification of, or deletion of third-party data
- Testing that causes significant disruption or degradation of production services
- Public disclosure of a vulnerability before reasonable coordination with TDI
- Exploitation of a vulnerability for financial gain or malicious purposes
- Activities that violate applicable laws or regulations
Reports resulting from non-compliant activities may still be reviewed to the extent reasonably possible.
16.Data Protection
TDI will process personal information submitted through the vulnerability reporting process in accordance with applicable privacy and data protection requirements.
Only information reasonably necessary for vulnerability investigation, communication, remediation, compliance, and disclosure will be processed.
17.CVD Process Closure
A vulnerability case may be considered closed when:
- the reported issue is determined not to be a vulnerability;
- the report is confirmed as a duplicate;
- the vulnerability has been fixed or appropriately mitigated and the relevant information has been communicated or published as appropriate; or
- further processing is not reasonably possible due to insufficient information or lack of communication from the reporter.
Where the reporter is not anonymous, TDI will normally notify the reporter when the CVD process has been completed.
18.Contact Information
www.tdintelligence.com/security/pgp/psirt.asc
www.tdintelligence.com/security/pgp/csirt.asc
19.Policy Review
This CVD Policy will be reviewed at least annually and updated as necessary to reflect changes in TDI products, processes, applicable cybersecurity requirements, and regulatory obligations.
Last Review Date: August 26, 2026
Next Review Date: August 26, 2026