cesnimda
32 lines
1.8 KiB
Markdown
32 lines
1.8 KiB
Markdown
# Rules of Engagement — TEMPLATE (fill before active testing)
|
|
|
|
## Ownership and approval
|
|
- Owner / authorized approver: **REQUIRED — fill in**
|
|
- Written authorization date: **REQUIRED**
|
|
- Source repository/revision(s): **REQUIRED**
|
|
- Approved staging hostnames/IPs and ingress origin: **REQUIRED**
|
|
- Explicitly in-scope containers, endpoints and internal mock services: **REQUIRED**
|
|
- Out of scope: production by default; third-party IDPs/payment providers; every other household service; non-owned accounts or data.
|
|
|
|
## Staging prerequisites
|
|
- Independent database, object/file storage, volumes and backups: [ ]
|
|
- Synthetic tenant A, tenant B and admin identities: [ ]
|
|
- Synthetic CVs, canary records and nonfunctioning fake credentials: [ ]
|
|
- OAuth/payment/webhook/email sandbox or mock: [ ]
|
|
- Access controls and outbound network restrictions: [ ]
|
|
- Observability, snapshot/rollback and emergency stop: [ ]
|
|
- Current baseline and staging safety smoke test: [ ]
|
|
|
|
## Approved attack classes
|
|
Individually check only after approval: [ ] low-rate authenticated negative testing; [ ] file handling with harmless fixtures; [ ] targeted source-guided injection tests to mocks; [ ] passive ZAP; [ ] capped active ZAP; [ ] infrastructure config tests; [ ] backup/restore in isolated test DB.
|
|
|
|
## Limits
|
|
- Max requests/sec and concurrency: **REQUIRED before network tests**
|
|
- Maximum test duration / windows: **REQUIRED**
|
|
- Excluded URL patterns/assets: **REQUIRED**
|
|
- Stop signal and contact: **REQUIRED**
|
|
- Stop on production data, unexpected hosts, resource exhaustion or unclear ownership.
|
|
|
|
## Evidence protection
|
|
No raw cookies/keys/PII in repo or prompts. Sanitized examples only. Controlled evidence stored securely, access-limited and deleted per policy. Reviewer sign-off required before stage 13 and any active scan.
|