IT Home On October 14, Huawei’s Security Emergency Response Center issued a announcement regarding the rules for handling subsequent vulnerability reports under the Huawei device security reward program.
According to official statements, this year there have been numerous reports of vulnerabilities that were discovered using AI tools for assistance. Most of these reports include PoC (Note from IT Home: Proof of Concept – code, scripts, request packets, or detailed reproduction steps that prove a security vulnerability exists and can be triggered) but false positives due to AI “hallucinations” still occur inevitably.
To allocate the limited review resources reasonably, ensure that the Huawei Terminal Security Reward Program review team can focus on genuine and effective vulnerabilities, and maintain a healthy and orderly community ecosystem, the following requirements are proposed:
1. Vulnerability report requirements
For vulnerability reports assisted by AI or discovered automatically, manual analysis and verification must be carried out before submission. We encourage white hats to provide a complete EXP attack chain verification. Please ensure that the report includes evidence of the actual security impact of the vulnerability, including but not limited to:
Dynamic fully executable PoC;
Affected products, system versions, and hazard descriptions (Note: The vulnerability must affect products within the reward program and have been upgraded to the latest HarmonyOS system version);
The report content is clear and easy to understand, and the steps for reproduction are straightforward and easy to follow.
Full log and result screenshots / demonstration video;
The attack path must be triggered from the entry point of a real attack scenario and must prove to have actual security impacts.
II. Non-standard behavior
During the entire process of participating in the reward program, white hats should always maintain mutual respect and communicate in a professional and friendly manner. The following behaviors are prohibited:
Continuous, repetitive, and large amounts of reports generated directly by AI, which cannot be manually replicated, are not triggered by the latest callable interfaces, contain incomplete code snippet analysis or verification, or provide verification results that can prove actual security benefits.
Distorting facts, maliciously damaging the Huawei terminal security reward program, or engaging in verbal attacks, insults, threats, harassment of staff, and excessive posting of messages are all malicious behaviors.
III. Handling of Non-Standard Behaviors
For the above-mentioned behavior in item 1, the platform will directly reject the related reports without providing reasons for rejection. For accounts that have submitted 3 such invalid reports in total, the platform will give a reminder; if the total reaches 5, the platform has the right to ban their Huawei Security Reward Program account.
For the above-mentioned behavior in item 2, Huawei Terminal Security Reward Program has the right to immediately terminate the participation status of its account holder (including teams/organizations) or impose permanent ban on them.
Additionally, the authorities have also adjusted the scope of vulnerability handling for tool-related issues:
Starting from September 30, 2026, vulnerabilities in Huawei terminal tools (such as DevEco) will not be accepted. However, if you discover vulnerabilities that can lead to supply chain poisoning in the public repository of self-developed tools or vulnerabilities that can affect the security of Huawei terminal devices through these tools, you are still welcome to submit them. We will provide a response after a comprehensive evaluation based on factors such as the impact of the vulnerability.