Brite Product Security Incident Response Team (Brite PSIRT)

 

Responsibility and Positioning

Brite Product Security Incident Response Team (Brite PSIRT) is the team responsible for receiving, investigating, responding to, and tracking security vulnerabilities in BriteSemi's products and technologies. The security incident response team's key responsibilities include:

● Receiving vulnerability reports from external security researchers, partners and customers;

● Performing technical verification and impact-scope assessment for reported security vulnerabilities;

● Coordinating internal R&D resources to develop fixes and interim mitigation measures;

● Following up on remediation progress to ensure timely release and deployment of solutions;

● Issuing security advisories and version-upgrade guidance to relevant stakeholders.

Vulnerability Handling Guidelines

Brite PSIRT processes incoming security-vulnerability reports following the standard workflow below:

Phase 1: Report Acknowledgement

Upon receiving a report, the team acknowledges receipt promptly and notifies the reporter that the report has been accepted.

Phase 2: Analysis and Assessment

The team conducts technical reviews of the vulnerability to verify its authenticity and reproducibility. Once a vulnerability is confirmed valid, its severity level and the scope of affected products will be further evaluated to determine remediation priority. If the submitted report lacks sufficient information, the team will communicate with the reporter by email to obtain supplementary materials.

Phase 3: Remediation and Validation

For confirmed vulnerabilities, the team collaborates with product R&D departments to drive remediation, deliver patches or interim mitigations, and perform regression validation after fixes are completed.

Phase 4: Coordinated Disclosure and Feedback

After fixes are validated, the team releases security advisories and patch-update guidance to reporters and affected customers through appropriate channels.

 

How to Report Security Vulnerabilities

Exploitation of security vulnerabilities may compromise product integrity, security and confidentiality. We welcome customers to report potential vulnerabilities or other possible security incidents. Timely vulnerability reporting enables us to implement fixes and communicate necessary remedial actions to customers, so as to improve product security and effectively manage security risks.

● Reporting Channels

If you discover potential security vulnerabilities in BriteSemi software or hardware products, please submit them to our Product Security Incident Response Team. You may send an email directly to psirt@britesemi.com.

● Communication Language: Chinese or English is acceptable.

 

Security Mechanisms

Given the sensitivity of vulnerability and security-incident information, encrypted transmission is recommended for your emails to protect confidentiality.

● PGP/GPG Public Key Fingerprint: B848 907F 73C8 F2D2 BB5C  B015 6B3B 45CE 325C 1D5A

● Public Key Download Link: Download (ZIP, 2 KB)

Recommended Encryption Tools (open source and free-of-charge):

● Gpg4win

● GnuPG

Throughout the entire vulnerability-handling lifecycle, Brite PSIRT will strictly limit the distribution of vulnerability information to only relevant handling personnel. We kindly request you to keep related information confidential before complete solutions are provided to customers.

 

Recommended Information to Include in Your Report

To help the security-response team accurately assess and efficiently address reported issues, please include as much of the following information as possible in your submission:

Information Category	Contents to Be Provided
Affected Products	Part numbers, versions, etc.
Vulnerability Description	Problem description, impacts; how and when the vulnerability was discovered.
Reproduction Details	Proof-of-Concept (PoC), reproduction steps, etc.
Public-Disclosure Status	CVSS (Common Vulnerability Scoring System) score (if available); Any existing public disclosures (e.g. academic papers) or disclosure plans.
Contact Information	Name, email address, phone number, etc.

Security Advisories

Brite PSIRT will publish security advisories at appropriate time to disclose key vulnerability information and remediation solutions to affected customers.