QNAP Newsroom

Taipei, Taiwan, December 22, 2025 — QNAP® Systems, Inc., a leading innovator in storage, networking, and computing solutions, today announced the annual progress of its 2025 QNAP Bounty Program, highlighting the company’s continued investment in product security and its commitment to transparent, structured collaboration with the global security research community.

Partnering with the Global Security Research Community

As of December 1, 2025, QNAP has received 224 vulnerability reports through its Bounty Program. Verified issues were assigned CVE (Common Vulnerabilities and Exposures) IDs and addressed through QNAP’s internal security response processes. All vulnerabilities classified as Critical or Important were remediated within one week, significantly reducing potential security exposure.

This year, 151 external security researchers contributed to strengthening QNAP product security. As of September, QNAP has awarded a total of US$88,000 in bounty rewards, recognizing responsible vulnerability disclosure and the research community’s role in improving user data protection. QNAP will continue to promote a Coordinated Vulnerability Disclosure (CVD) culture and deepen long-term collaboration with the security ecosystem.

“Transparent reporting channels and close collaboration with the research community are fundamental to strengthening an organization’s security maturity,” said Stanley Huang, Senior Manager of QNAP's Product Security Incident Response Team.

Active Participation in Global Security Competitions and Professional Testing

To ensure products remain resilient against real-world threats, QNAP actively participates in international security competitions and third-party security assessments, including:

• Pwn2Own 2024 and Pwn2Own 2025 — validating product defenses under high-intensity attack scenarios
  

• Public-sector vulnerability hunting programs — validating product security through structured testing and coordinated disclosure
  

• Red team penetration testing by leading security firms — simulating full attack chains to further strengthen the resilience of the QuTS hero operating system

These efforts not only broaden QNAP’s offensive and defensive security insights, but also accelerate the implementation of internal security improvements.

Process Optimization and Strengthened Security Governance

To build a more secure and transparent product development environment, QNAP has further enhanced key components of its Secure Software Development Lifecycle (SDLC), including:

• AI-assisted code review: Leveraging AI technologies to improve code review efficiency through automated vulnerability detection and reduced human error.
  

• Establishment of a Software Bill of Materials (SBOM): Maintaining transparent visibility into software components to help organizations better manage supply chain risks and meet security compliance requirements.
  

• Strengthened security across development and testing workflows: Integrating vulnerability detection into CI/CD automation to identify issues early, while utilizing professional scanning tools during QA/QC testing to ensure vulnerabilities are thoroughly identified and remediated prior to product release.

For more information about the QNAP Bounty Program and product security initiatives, please visit: https://www.qnap.com/go/security-bounty-program/