Start with explicit permission.
Only test assets listed in an active program’s scope. Read the program policy, exclusions, and reward conditions before taking any action. A listing on this platform does not authorize testing unrelated systems.
Responsible research.
Shared responsibility.
A few clear principles help researchers and companies
turn discoveries into safer technology.
Respect people and boundaries.
Use researcher-owned test accounts. Avoid accessing other people’s data, disrupting services, or using social engineering. Do not perform denial-of-service testing unless a program explicitly authorizes it.
Make the finding reproducible.
Explain the affected asset, the issue, numbered steps to reproduce it, and the demonstrated impact. Share only the minimum evidence needed, and avoid including unnecessary secrets or personal information.
Keep discoveries private.
Share findings through the program’s report workflow. Avoid public disclosure until the company and researcher have agreed on an appropriate timeline and the issue has been addressed.
Work toward resolution.
Security is a conversation. Researchers should answer reasonable requests for details; companies should communicate clearly about triage, remediation, and any reward decisions. Program-specific policies govern testing and reward eligibility.
These principles describe platform expectations. They do not replace a program’s policy or provide a legal safe-harbor agreement.