Go as far as the program's scope and rules allow, and no further. Use accounts you own, stop as soon as you can show the issue exists, redact personal data from your evidence, and never touch data that belongs to other people beyond what is unavoidable.
Authorization comes first
The OWASP cheat sheet tells researchers to make sure testing is authorized and stays within the program's scope and rules. If there is no program, you have no written permission, and that is a risk you carry. A disclosure policy with safe harbor language lowers the risk but only for what it explicitly covers. See what safe harbor means.
Read the scope literally
Look for three lists: assets in scope, assets out of scope, and bug classes that are not accepted. Third party services, shared infrastructure and customer systems are common exclusions. If an asset is not listed, ask before you test it.
Use your own accounts
Create two test accounts to show that one user can reach the other's data. You rarely need a real person's records. Showing that a request returns an object belonging to your second account proves the same point with no privacy cost.
Redact before you send
OWASP asks researchers to respect privacy and to redact personal data from evidence. Blur names, emails, tokens and cookies in screenshots. Trim logs. If you accidentally saw real data, say so in the report, do not keep copies, and do not share them.
Stop early
You do not need to dump a database or pivot into the network to prove impact. A single harmless read, or a benign payload that displays a marker, is enough. Impact can be argued from what you showed. Going further turns a report into an incident and can void protections.
Do not run load tests, brute force logins at scale, or send messages to real users. Automated scanners can be noisy and some programs ban them. Check the rules.
When something goes wrong
If you cause an outage or reach data you should not have, stop and tell the team at once. Honest, fast reporting is the best defence. Then follow the guidance in writing a clear vulnerability report.
Quick check
Can I test a company's site if it has no bounty?
Without permission you carry the legal risk yourself. Look for a disclosure policy first, and consider legal advice if unsure.
What if the scope is unclear?
Ask the security contact before testing. A short question costs nothing.
Sources
- OWASP: Vulnerability Disclosure Cheat Sheet
- disclose.io: safe harbor guidance
Last reviewed: 19 October 2026.
