Vulnerability Reporting

• Official reporting channel — Reports should be submitted through the official Security Contact/Vulnerability Reporting channel published by Vietnam Office.
• Recommended report information — Include the affected Product/System, Version/Release, Platform, vulnerability description, reproduction steps, expected impact, technical evidence, and reporter contact details where appropriate.
• Do not submit unnecessary sensitive data — Reporters should not submit Passwords, OTPs, Private Keys, Card data, other people's personal data, or confidential information not necessary to demonstrate the vulnerability.
• Responsible Disclosure — Reporters should allow Vietnam Office a reasonable period to verify and remediate an issue before broadly disclosing information that could increase user risk.
• Do not cause disruption — Research should not intentionally destroy data, cause DoS, disrupt services, access unnecessary data, or expand testing beyond what is required.
• No exploitation for gain — Vulnerabilities must not be used for unauthorized access, License theft, transaction fraud, or gain from other users' data.
• Triage and classification — Vietnam Office evaluates reports based on validity, affected scope, exploitability, and risk level.
• Verification and remediation — Valid vulnerabilities may enter an analysis, remediation, testing, and Security Update process as appropriate.
• Report tracking — Vietnam Office may issue a Case/Reference ID to support communication and tracking.
• Researcher acknowledgement — Researcher recognition, where offered, depends on disclosure policy and the consent of the relevant parties.

Vulnerability Reporting principle: report through official channels → provide necessary technical information → avoid harm → Vietnam Office verifies → triages → remediates → issues Security Updates/notifications where required.