Rules of Engagement — TEMPLATE (fill before active testing)

Ownership and approval

Owner / authorized approver: REQUIRED — fill in
Written authorization date: REQUIRED
Source repository/revision(s): REQUIRED
Approved staging hostnames/IPs and ingress origin: REQUIRED
Explicitly in-scope containers, endpoints and internal mock services: REQUIRED
Out of scope: production by default; third-party IDPs/payment providers; every other household service; non-owned accounts or data.

Staging prerequisites

Independent database, object/file storage, volumes and backups: [ ]
Synthetic tenant A, tenant B and admin identities: [ ]
Synthetic CVs, canary records and nonfunctioning fake credentials: [ ]
OAuth/payment/webhook/email sandbox or mock: [ ]
Access controls and outbound network restrictions: [ ]
Observability, snapshot/rollback and emergency stop: [ ]
Current baseline and staging safety smoke test: [ ]

Approved attack classes

Individually check only after approval: [ ] low-rate authenticated negative testing; [ ] file handling with harmless fixtures; [ ] targeted source-guided injection tests to mocks; [ ] passive ZAP; [ ] capped active ZAP; [ ] infrastructure config tests; [ ] backup/restore in isolated test DB.

Limits

Max requests/sec and concurrency: REQUIRED before network tests
Maximum test duration / windows: REQUIRED
Excluded URL patterns/assets: REQUIRED
Stop signal and contact: REQUIRED
Stop on production data, unexpected hosts, resource exhaustion or unclear ownership.

Evidence protection

No raw cookies/keys/PII in repo or prompts. Sanitized examples only. Controlled evidence stored securely, access-limited and deleted per policy. Reviewer sign-off required before stage 13 and any active scan.

1.8 KiB Raw Blame History