Rules of Engagement

1. Authorization

Testing is performed only against a domain verified through the published challenge, and only after a request has been accepted through the portal by an authorized representative of the organization.

The authorization record captures the accepted attestation, this document's version, the timestamp, the source IP address, and the user agent.

2. In scope

The verified domain and hostnames beneath it that resolve to infrastructure attributable to the organization.

3. Out of scope

Hostnames hosted by third-party providers, including but not limited to hosted status pages, storefronts, documentation platforms, and static-site hosts, even where they sit beneath the verified domain.

Systems that resolve to private, reserved, or internally routable addresses.

Denial-of-service or load testing of any kind.

Social engineering, physical access, and testing of employees.

Persistence, backdoors, and destructive actions. Where a finding requires writing to a system, the minimum necessary is used and the change is reverted where possible.

4. Data handling during testing

Evidence is limited to what demonstrates a finding. Personal data encountered incidentally is not extracted beyond proof and is redacted in the report where practical.

A finding that indicates an active compromise or imminent risk is reported to the organization as soon as it is confirmed, before the report is finalised.

5. Suspension

Testing stops if the verification record disappears, if the organization requests a stop, or if activity indicates the asset is no longer under the organization's control.