China Cybersecurity Law (CSL) 28-29: Art. 28-29 Certification, testing, assessment and vulnerability disclosure under state rules; no attacks, no attack tools, no assistance to attackers

Entities conducting cybersecurity certification, testing, risk assessment or releasing information on vulnerabilities, viruses, attacks or intrusions must comply with the relevant national regulations; no individual or organisation may intrude into others' networks, interfere with their normal functioning or steal network data, provide programs or tools specifically for such activities, or, knowing that others engage in them, provide technical support, advertising, payment settlement or other assistance; violators face detention, fines and five-year or lifetime bars from cybersecurity and key network positions.