Sungrow welcomes security researchers, customers, partners, and other stakeholders to report potential security vulnerabilities in our products and services. Your feedback helps us continuously improve product security and better protect our customers and business operations.

If you discover any security vulnerabilities within Sungrow’s products or services, please submit your vulnerability report via the channel below.

Submission Channel

Email:psirt@sungrowpower.com
To protect the confidentiality of vulnerability details, PGP-encrypted submission is highly recommended.

PGP Public Key:48DC700294BC32C1
Key Fingerprint:AEF29AB58E8626351AE8913448DC700294BC32C1
Download Link:https://keys.openpgp.org/search?q=AEF29AB58E8626351AE8913448DC700294BC32C1

Information to Include

To help us efficiently analyze and validate reported vulnerabilities, please provide as much of the following information as possible:
● Product name and model
● Software, firmware, or system version
● Detailed description of the vulnerability
● Potential impact and risk assessment
● Steps required to reproduce the vulnerability
● Test environment information
● Proof-of-Concept (PoC) code, test scripts, logs, screenshots, or other supporting materials
● Contact information (optional)
You may refer to the Vulnerability Report Template attached to draft your vulnerability report. Anonymous submissions are accepted. However, please note that if no valid contact information is provided, we may be unable to communicate with you regarding validation results, remediation progress, or other follow-up matters.

Response Commitment

Upon receiving a vulnerability report, the Sungrow PSIRT will initiate analysis and validation as soon as possible.
Under normal circumstances:
● Receipt of your report will be acknowledged within 2 days.
● Initial assessment and validation results will be provided within 7 days.
We will keep reporters informed of significant progress throughout the vulnerability handling process. For complex vulnerabilities or vulnerabilities affecting multiple products, additional time may be required for thorough investigation and remediation.

Vulnerability Handling Process

All vulnerability submissions are processed following the standardized PSIRT workflow:
Reception → Assessment → Remediation → Disclosure → Improvement.
For validated vulnerabilities, we formulate remediation plans based on risk severity and impact scope, and release relevant security advisories or fix recommendations as appropriate.
For detailed rules covering disclosure principles, researcher rights and safe harbor provisions, please refer to our Vulnerability Disclosure Policy.

Overview

Sungrow is committed to maintaining the security of its products, services, and customers. We welcome security researchers, customers, partners, and other stakeholders to responsibly report potential security vulnerabilities that may affect Sungrow products, systems, or services.

By working collaboratively with the security community, we can identify, assess, and remediate security issues more effectively, helping to strengthen the overall security of our products and services.

Scope

This policy applies to all of Sungrow's products.

How to Report a Vulnerability

If you believe you have identified a security vulnerability affecting a Sungrow product or service, please submit your report through one of the following channels:

Security Email
psirt@sungrowpower.com

PSIRT Portal
https://www.sungrowpower.com/en/security-incident-response

To protect the confidentiality of vulnerability information, we recommend using PGP encryption when submitting vulnerability reports.

Information to Include

To facilitate efficient analysis and validation, vulnerability reports should include as much of the following information as possible:

Affected product name and model

Software, firmware, or system version

Detailed description of the vulnerability

Vulnerability type (e.g., privilege escalation, remote code execution, authentication bypass)

Potential impact and risk assessment

Steps required to reproduce the vulnerability

Test environment information

Proof-of-Concept (PoC) code, scripts, logs, screenshots, or other supporting materials

Contact information (optional)

The more complete the information provided, the more efficiently we can evaluate and address the reported issue.

Vulnerability Handling and Response Commitment

Vulnerability reception and confirmation: We will confirm receipt of your report within 2 days.

Vulnerability verification and Assessment: Complete preliminary verification and impact assessment within 7 days, and provide you with feedback on our remediation plan.

Vulnerability remediation: Develop a repair plan based on the risk level, and develop and test patches.

Security Updates and Announcement Releases: Notify affected customers, release security updates, and publish vulnerability advisories.

For complex vulnerabilities, the processing time may be extended. Throughout the entire vulnerability handling process, PSIRT will maintain regular communication with the reporter, providing updates on the current status of the handling.

Coordinated Vulnerability Disclosure

Sungrow addresses security vulnerabilities in accordance with the Coordinated Vulnerability Disclosure (CVD) framework.

Confidentiality of Information: Throughout the entire vulnerability handling lifecycle, Sungrow PSIRT will strictly restrict access to vulnerability information and only share such data with personnel directly involved in resolving the vulnerability. Meanwhile, reporters are requested to keep all vulnerability information confidential until a complete remediation solution is made available to our customers.All vulnerability-related materials you submit (including but not limited to vulnerability descriptions, reproduction steps, PoC code, affected product models, attack chains, test screenshots, etc.) shall be treated as confidential information from the date your vulnerability report is received until both parties reach a written agreement on public disclosure. During this confidentiality period, you must not disclose, distribute or publish any of the aforementioned materials to any third party.

Negotiation of Disclosure Timeline: Once a vulnerability fix is ready for release, we will negotiate with you to finalize the official public disclosure date. Any public release of vulnerability information in any form must be discussed in advance with the Sungrow PSIRT Team, and may only proceed after both sides reach written consensus on the disclosure timeline, content and publication method.Permitted disclosure forms include, but are not limited to:

Safe Harbor

Sungrow appreciates and supports good-faith, responsible security research activities.

For individuals conducting security research in good faith and complying with this Policy, Sungrow commits that it will not initiate lawsuits or take legal action against them, provided all of the following conditions for the research activities are met:

Reproduce vulnerabilities only through verification with minimal impact; do not tamper with, delete or steal business data or device configurations. Immediately terminate testing and submit a report upon accessing any sensitive data.

Do not cause service disruption to customers, partners or Sungrow.

Do not launch Denial-of-Service (DoS) attacks.

Do not leverage vulnerabilities for lateral movement, persistent control or further exploitation attacks.

Do not profit from vulnerabilities, engage in extortion, or trade vulnerability information.

Do not violate any applicable laws and regulations.

Do not publicly disclose vulnerability details before the corresponding patch is fully released.

Sungrow reserves the right to take appropriate measures if any research activity falls outside the scope specified above.

Personal Safety Tips

Some products of Sunshine power supply involve high-voltage power equipment, which has safety risks such as electric shock and arc. Investigators should conduct tests in a safe environment, comply with electrical work safety regulations, and wear appropriate personal protective equipment when necessary.

Acknowledgements And Recognition

Sungrow appreciates the valuable contributions of the security research community.

For valid and responsibly reported vulnerabilities, Sungrow may acknowledge the reporter's contribution. With the reporter's consent, recognition may be provided through security advisories, acknowledgments, or other appropriate channels.

Currently, Sungrow does not operate a public bug bounty program. Should such a program be introduced in the future, detailed information will be published on the official website.

Contact

For questions regarding this VDP or other product security matters, please contact Sungrow PSIRT:psirt@sungrowpower.com

Privacy Notice for Vulnerability Reports

When you submit a vulnerability report to Sungrow PSIRT (via web‑portal or email to psirt@sungrowpower.com), we may process your contact information (provided optionally) for purposes of report acknowledgement, status update, coordinated‑disclosure negotiation and recognition upon your consent.
Such personal data processing shall be governed by the SUNGROW Website Privacy Policy. Your personal data will be retained for the period necessary to complete vulnerability remediation and coordinated disclosure, after which your personal identifiable information will be securely deleted unless a legal retention obligation applies. We will not publish your personal information in security advisories without your explicit consent. You may exercise your data subject rights described in the Privacy Policy by contacting psirt@sungrowpower.com.