2.1 Reporters shall submit vulnerabilities through the designated platform  (www.en-plustech.com) and according to the provided guidelines.
2.2 Vulnerability reports should include:

• Description of the vulnerability and its potential impact;
• Steps to reproduce, operational procedures, or PoC;
• Test environment information (URL/APP, code snippets, device model, system version, test IP, account information, etc.);
• Screenshots, logs, and other materials generated during testing.

2.3 Acceptable scope includes:

• The EN+ official website (www.en-plustech.com);
• EN+ official APPs (e.g., EVCHARGO, Installer App, etc.);
• EN+ hardware and backend systems within the warranty/maintenance period.

2.4 The following are not accepted:

• Products no longer for sale and no longer maintained;
• Issues with third-party platforms or services;
• Already publicly known or previously submitted vulnerabilities.

2.5 Vulnerability rating considers factors including:

• Degree of exposure and harmfulness of sensitive data;
• Exploitation difficulty;
• Whether it is propagable or widely exploitable.

2.6 Vulnerability disclosure principles:

• Do not disclose vulnerabilities publicly without written permission from EN+;
• When disclosure is permitted, do not include sensitive information;
• Disclosure content must be objective and accurate; exaggeration or creating unnecessary panic is prohibited.

2.7 Reporters must ensure submitted materials are truthful and lawful and must not cause risks due to false information.
2.8 Reference remediation timelines:

• High-risk and above: In principle, within 90 business days;
• Medium-low risk: In principle, within 180 business days;
• Special circumstances will be notified separately.