JD.com Suspends External Security Testing and Vulnerability Submissions During Double 11
JD.com's Security Response Center (JSRC) has announced a temporary suspension of all external authorized security testing and vulnerability submissions from October 18 to November 18, 2026. This decision aims to protect production systems during the high-traffic Double 11 shopping festival, following recent disruptions caused by unauthorized AI-powered testing tools. This policy highlights how major technology companies are adjusting their operational strategies to cope with the rise of automated, AI-driven vulnerability testing during critical traffic surges. It underscores the delicate balance between crowd-sourced security research and maintaining system stability under heavy commercial loads. During the suspension period, any unauthorized testing on JD.com's assets will be treated as a violation, leading to account restrictions or bans, with potential legal liabilities under relevant Chinese cybersecurity laws. Normal vulnerability collection is scheduled to resume after November 18, 2026.
## BACKGROUND
Security Response Centers (SRCs) act as a bridge between tech corporations and security researchers, often referred to as white-hat hackers, who find and report system vulnerabilities safely. Major shopping events like Double 11 experience extreme user traffic and transaction volumes, making production environments highly sensitive to unexpected disruptions or automated scanning interference.