Authorized Security Testing Terms

Authorization and scope

• the customer must control each asset or provide explicit owner permission;
• cloud, hosting, SaaS and other third-party approvals remain the customer’s duty;
• the RoE states exact assets, methods, time, limits, exclusions and emergency contacts;
• scope changes require explicit approval from both parties; silence is not consent.

Default exclusions

Without expanded RoE, DoS/stress testing, social engineering, malware, persistence, destructive actions, collection beyond minimum proof, password attacks, out-of-scope pivoting, and life-safety, OT/ICS or critical-infrastructure testing are forbidden. Synthetic/rehearsal functions cannot be treated as production execution.

Evidence and stop-test

Access is minimized, secrets redacted and whole databases are never copied merely as proof. Either party may stop testing immediately. Outage, data loss, unexpected access, third-party impact, an active incident or ambiguity requires a pause until named contacts explicitly resume.

Legal boundary

Authorization binds only the parties and exact RoE. It cannot bind an owner, provider or authority that did not consent. Security-research exemptions are not blanket safe harbor. Doubt always pauses testing.