Hardware Vulnerability Prioritization: How OPPO Manages CRA Compliance

This case study describes OPPO's migration of its vulnerability disclosure program to HackerOne to broaden researcher coverage, distinguish hardware from software reports via clear diagnostic rules, prioritize fixes based on user impact, and implement a two-stage remediation and verification workflow that produces an auditable trail to satisfy EU Cyber Resilience Act requirements.