How I work, and what I won't do.

I only test systems I have explicit, written permission to test. No grey-area "they probably wouldn't mind" engagements. No surprise discoveries.

In-scope assets are the only things I touch. Out-of-scope means out-of-scope, even if a finding looks tempting. Scope changes happen in writing.

Engagement detail, vulnerabilities, and client identities are confidential. Anything I share publicly is sanitised, redacted, and approved.

Critical findings reach the client inside hours, never buried in a final report. Public disclosure waits until remediation has had a fair chance.

Tests are run with rate limits, off-hours coordination, and rollback plans. Production access is treated as a privilege, not a permission slip.

If I'm not sure a vulnerability is exploitable, I say so. False positives waste your team's time as much as missed criticals do.