Authorized vulnerability research
Bug bounty hunting starts with scope, not a scanner.
A defensible researcher can explain the authorization, target, test account, traffic level, data boundary, reporting path, stop condition, and evidence-handling plan before sending the first request.
No written scope, no test. A public hostname or reachable service is not permission.
Before testing
Convert the program policy into an executable boundary.
Capture authority
Save the program policy, scope, safe-harbor language, allowed and prohibited techniques, rate limits, disclosure terms, and the time they were reviewed.
Resolve ownership
Confirm that the exact hostname, application, API, mobile build, IP range, tenant, and third-party dependency are in scope. Wildcards need careful interpretation.
Prepare identities
Use researcher-owned test accounts and test data. Never assume permission to access another person’s account, message, file, token, or transaction.
Define stop conditions
Stop on sensitive data, service instability, cross-tenant access, privileged access, evidence of a breach, unexpected third-party systems, or a policy conflict.
Safe research workflow
Find the minimum proof that demonstrates impact.
Map the attack surface
Read documentation and client behavior; inventory endpoints, roles, object identifiers, state changes, trust boundaries, and error conditions without creating load.
Test one hypothesis
Change one variable at a time. Use the lowest request rate and least privilege that can disprove or confirm the suspected control failure.
Minimize evidence
Capture request and response metadata, timestamps, identifiers created by the researcher, and redacted screenshots. Do not collect unrelated records “for proof.”
Report reproducibly
State prerequisites, affected component, exact steps, expected and observed results, security impact, data touched, cleanup performed, and a remediation hypothesis.
Coordinate disclosure
Use the program’s channel and timeline. Preserve messages and respect remediation timeframes. Do not pressure a target with threats, sales demands, or public exposure.
Retest only when invited
Confirm whether validation is authorized. Retest the smallest condition, record the fixed behavior, and report variants without expanding scope.
Techniques requiring explicit permission
High-impact activity is not implied by a generic bounty.
- Denial of service, stress, volumetric, or resource-exhaustion testing
- Social engineering, phishing, physical access, credential attacks, or employee targeting
- Automated scanning at material volume or across third-party infrastructure
- Persistence, malware, command-and-control, destructive payloads, or modification of other users’ data
- Accessing, downloading, retaining, or publishing personal, financial, health, controlled, export-controlled, or customer information
- Supply-chain, cloud-account, identity-provider, or vendor systems not expressly listed in scope
A program’s safe harbor is bounded by its text. The U.S. Department of Justice’s charging policy recognizes good-faith security research, but it is not a universal permission slip and it does not replace target authorization, other laws, contracts, or the rules of a specific program.
Defensive resources
Use policies that make authorized help possible.
CISA vulnerability disclosure
CISA’s directive and model approach emphasize a public policy that tells researchers which systems and activities are authorized and how to report safely.
DOJ CFAA policy
The Justice Department defines good-faith research around testing, investigation, or correction conducted to avoid harm and primarily improve security or safety.
security.txt
Publish a current disclosure contact and policy location, monitor the mailbox, protect reports, and set realistic acknowledgement and remediation expectations.
Kythos AI operating boundary
Research is restricted to owned systems or explicit written authorization.
Kythos AI does not offer pass-through access to a third-party program, platform, account, or target. References to CISA, DOJ, program operators, or research platforms are informational and do not imply partnership, endorsement, or legal advice.