Security Policy

Core principles

• Safety first: No testing that risks system stability or data integrity.
• Authorization required: All external testing requires clear written permission.
• Data minimization: No unnecessary collection or retention of sensitive data.
• Transparency: Findings are documented clearly and shared only with authorized parties.
• Ethics above opportunity: No use of research for exploitation or unauthorized gain.

Operational boundaries

• No probing or scanning outside explicitly sanctioned scopes.
• No exploitation beyond what is necessary to demonstrate and confirm impact.
• No intentional interaction with real user data unless unavoidable and explicitly authorized.
• No denial-of-service, resource exhaustion, or destructive actions.

Use of tools

Tools such as HTTP proxies, traffic analyzers, log processors, and AI-based assistants are used only to support authorized research. Their purpose is to improve visibility, shorten feedback loops, and sharpen analysis – not to extend scope or bypass agreements.