Hoymiles Vulnerability Disclosure Policy

Hoymiles Power Electronics Inc. is a company focused on the photovoltaic and energy storage business. Our vision is to become a world-class smart energy partner.

This vulnerability disclosure policy applies to any vulnerabilities you are considering reporting to us. We recommend reading this vulnerability disclosure policy fully before you report a vulnerability and always acting in compliance with it.

Reporting

If you believe you have found a security vulnerability, please submit your report to us using the following email:

Cybersecurity@hoymiles.com

In your report please include:

Vulnerability Details:

  • Asset (web address, IP Address, product or service name) where the vulnerability can be observed
  • Title of vulnerability
  • Description of vulnerability (this should include a summary, supporting files and possible mitigations or recommendations)
  • Impact (what could an attacker do?)
  • Steps to reproduce. These should be a benign, non-destructive, proof of concept. This helps to ensure that the report can be triaged quickly and accurately. It also reduces the likelihood of duplicate reports, or malicious exploitation of some vulnerabilities, such as sub-domain takeovers.

Optional Contact Details:

  • Name
  • Email Address

What to expect

After you have submitted your report, we will respond to your report within 5 working days and aim to triage your report within 20 working days（The resolution time varies depending on the severity of the issue).

Priority for remediation is assessed by looking at the impact, severity and exploit complexity. Vulnerability reports might take some time to triage or address.

We will notify you when the reported vulnerability is remediated, and you may be invited to confirm that the solution covers the vulnerability adequately.

Guidance

Do NOT:

  • Break any applicable law or regulations
  • Disrupt the Organization’s services or systems
  • Modify data in the Organization’s systems or services
  • Use invasive or destructive scanning tools to find vulnerabilities
  • Access unnecessary, excessive or significant amounts of data
  • Attempt or report any form of denial of service, e.g. overwhelming a service with a high volume of requests