Vulnerabilities must be reported per regulations; no details, exploit tools, or disclosure to foreign entities before patching

No cost involved. Simply report the vulnerability to the product vendor or an official platform. Until the vendor releases a patch, no details or verification code should be disclosed.

These regulations govern three main groups: domestic network product vendors, network operators, and any organizations or individuals involved in discovering, collecting, or publishing vulnerability information. No entity may use vulnerabilities to compromise network security, nor may they illegally collect, sell, or distribute such information. Five additional rules apply to public disclosure: first, nothing may be released before a vendor provides a patch; second, no details about vulnerabilities in active networks or systems may be published; third, no exaggerated claims about risks or malicious exploitation attempts may be made; fourth, no tools or programs designed for malicious exploitation may be released; and fifth, any disclosure must include remediation steps. Unreported vulnerabilities must also not be shared with foreign entities. The regulations encourage reporting to four official platforms: the Ministry of Industry and Information Technology’s Cybersecurity Threat and Vulnerability Information Sharing Platform; the National Cybersecurity Information Notification Center’s Vulnerability Platform; the National Computer Network Emergency Response Technical Team/Coordination Center of China’s Vulnerability Platform; and the China Information Security Evaluation Center’s Vulnerability Database. Violators may face penalties ranging from fines of 10,000 to 100,000 RMB, suspension of services, revocation of licenses or business licenses, and even criminal liability for responsible personnel.

工业和信息化部、国家互联网信息办公室、公安部 (2021). 网络产品安全漏洞管理规定（工信部联网安〔2021〕66 号，第二、四、九、十、十四条，2021 年 9 月 1 日施行）. https://www.gov.cn/gongbao/content/2021/content_5641351.htm；全国人大常委会 (2025). 网络安全法（2025 年修正，2026 年 1 月 1 日施行，第二十八、六十五条；2016 年文本为第二十六、六十二条，规定第十四条援引的是 2016 年文本的条号）. https://www.cac.gov.cn/2025-12/29/c_1768735112911946.htm

The regulation expressly includes individuals among those covered; “I’m only an amateur” is not an exception. Submitting a bug in a domestic system to a foreign bug-bounty platform falls squarely under “unpublished vulnerabilities must not be provided abroad.” Whether you are allowed to test is in item 9 (do not test others’ systems without written authorization); that is separate from how you handle a vulnerability once you have it. A lawfully found vulnerability can still draw a penalty for unlawful publication; a vulnerability found without authorization has problems on both the testing and the publishing sides. The regulation does not specially address “the vendor was notified but does not fix.” The author’s advice is to keep records of negotiation and reporting, and also report to the four official platforms above.