The law (Source: https://en.wikipedia.org/wiki/China_Internet_Security_Law) :
> Regarding the requirements for spot-checks and certifications, international law firms have warned that companies could be asked to provide source code, encryption, or other crucial information for review by the authorities, increasing the risk of this information being lost, passed on to local competitors, or used by the authorities themselves.