Skip to main content
Security testing requires explicit authorization to ensure compliance with legal frameworks and cloud provider acceptable use policies.

​
Establishing Scope

  1. Target Specification: List FQDNs, IP addresses, and URL roots.
  2. Exclusion List: Explicitly ban sensitive third-party integrations (e.g., third-party payment gateways, third-party SMS providers).
  3. Authorization Attestation: Confirmation by an authorized Security Administrator that your organization owns or holds testing rights for the targets.