Product Support Policy Overview

RayNeo Health is committed to providing continuous security updates for our smart glasses, covering the RayNeo brand.

Updates generally include the latest security patches, vulnerability fixes, and other security improvements. Typically, RayNeo Health will provide security updates for at least 2 years after the first shipment of a certain device model. RayNeo Health regularly publishes and updates the end-of-life (EOL) product list below to help you check whether your smart glasses can receive security updates.

Extended Support: RayNeo Health may support the security updates for 3 years or longer for some models, which are subject to actual conditions. If a very serious security vulnerability is discovered, RayNeo Health may also provide the necessary security fixes to you, even if your device is in the EOL product list.

Product List

EOL Product List

RayNeo Health no longer maintains software or firmware updates (including security updates) for the products listed below. Security vulnerability reports for these products may no longer be accepted.

Vulnerability Response and Disclosure Process

Our structured approach to handling reported vulnerabilities ensures timely and effective resolution.

Reporting a Vulnerability

Escalation and Decision Making

Escalation criteria are defined based on incident severity and impact to ensure critical vulnerabilities receive appropriate management attention without undue delay.

Escalation Criteria

Escalation may be initiated when any of the following conditions are met:

• Confirmed active exploitation
• Significant impact to users or services
• Widespread product exposure
• Regulatory reporting obligations
• Inability to remediate within defined SLA timelines

Decision Authority

Critical decisions — including public communication and regulatory reporting — are made by authorized roles based on predefined thresholds. Acknowledgement and communication activities may be prioritized or accelerated for vulnerabilities assessed as critical, actively exploited, or associated with significant customer or operational impact.

Timeliness

Escalation may be initiated where acknowledgement timelines are exceeded or communication activities are delayed for critical vulnerability reports. Escalation paths ensure that critical vulnerabilities and significant cybersecurity incidents are brought to the attention of appropriate management levels without undue delay.

Documentation

Escalation records, decisions, and approvals are documented within the vulnerability management process. Escalation procedures support management awareness and corrective actions where communication timelines, acknowledgement expectations, or disclosure coordination activities are delayed or not achieved as expected.

Business Scope Eligible for Security Vulnerabilities

Coverage — In-Scope Domains & Products

• *.rayneo.com
• *.rayneo.cn
• RayNeo App
• RayNeo AR App
• RayNeo XR App
• RayNeo AI App
• WeChat Mini Program

Vulnerability Handling Process

Internal Triage & Fix SLA

Internal Handling Timeline by Severity

• Critical  Triage within 1 business day; fix begins immediately after confirmation
• High Risk  Triage and fix within 3–5 working days
• Medium Risk  Fix within 15 working days
• Low Risk  Fix or address within 30 working days

Ongoing Communication

Status Updates & Verification Outcomes

We maintain ongoing communication with vulnerability reporters and stakeholders throughout the handling lifecycle. Progress updates may be provided at key milestones:

• Initial triage completion
• Validation or reproduction activities
• Remediation planning and availability
• Coordinated disclosure preparation
• Case closure

Additional updates may be triggered by significant changes in vulnerability severity, exploitation status, remediation timelines, or other material developments. For critical or actively exploited vulnerabilities, communication may be accelerated to support timely coordination and risk reduction.

Verification outcomes: Reporters will be informed of verification results — confirmation of a valid vulnerability, inability to reproduce the issue, requests for additional information, duplicate report determination, or out-of-scope classification. All communications are recorded within the vulnerability tracking process.

Continuity: Communication is maintained throughout the lifecycle, including during escalation situations, personnel transitions, or operational continuity events.

Vulnerability Communication Roles & Responsibilities

Clear division of responsibilities across departments ensures a structured and accountable vulnerability response process.

Vulnerability Rating Rules

RayNeo Health evaluates reported vulnerabilities using the Common Vulnerability Scoring System, CVSS v4.0, where applicable. Each report is assigned a CVSS Base Score, which determines the severity rating and corresponding reward level.

The assessment considers factors including:

• Exploitability
• Attack complexity and required privileges
• User interaction requirements
• Exposure of the affected asset
• Impact on confidentiality, integrity, and availability
• Potential customer, operational, privacy, or safety impact
• Active exploitation or availability of public exploit code
• Availability of compensating controls or mitigations

RayNeo Health may adjust remediation priority based on product context, affected deployment environments, exploitation status, customer impact, and other relevant business or regulatory risks.

Security Testing Considerations

• The reward standard is only for threat intelligence affecting RayNeo Health products and business.
• The right to interpret the processing procedures and grading rules belongs to RayNeo Health.
• Researchers are not allowed to disclose vulnerability details on any public channels.
• Multiple vulnerabilities from the same source are counted as one; only the earliest submitter is credited.
• The final contribution value is determined by factors including difficulty and scope of influence.
• It is strictly forbidden to use automated scans or auxiliary tools for high-frequency scanning.
• It is strictly forbidden to use vulnerabilities for illegal operations (e.g. data theft, lateral movement).
• Do not use security testing to damage user interests, affect normal operations, or steal user data.

Secure Disclosure — Report a Vulnerability

Submit your findings through the secure form below. Fields marked with an asterisk (*) are required.