Security Testing Authorization and Rules of Engagement

1. Why permission is needed

Testing a system for vulnerabilities without its owner’s permission can be an offence. The Provider therefore tests only the systems the Customer authorises under this document. The Customer accepts it in its project before vulnerability testing starts, for each scope; the record shows who accepted it, when, and for which systems.

2. Who authorises

The person accepting confirms that the Customer owns or controls the systems in scope, or has their owner’s written permission, and that testing is allowed by the rules of every hosting, cloud or platform provider involved (some plans, such as Vercel Hobby, forbid it). The Customer remains responsible for authorising only systems it may authorise.

3. Scope

Only the app addresses, API endpoints and environments listed in the test plan are in scope, tested with the test accounts the Customer provides, preferably in a staging environment. Third-party services the app uses — payment, e-mail and sign-in providers — are out of scope, except for how the Customer’s app uses them.

4. Testing window and contacts

Testing runs on business days within the window stated in the test plan, Kyiv time. The Customer names a contact in the project chat for urgent questions. Either party may pause testing at any time by writing in the chat.

5. Allowed and forbidden techniques

Allowed: manual testing of access control and other users’ data, sign-in and sessions, input handling, payment logic with test cards, exposed keys and configuration, administrative functions and APIs; automated scanning at a moderate rate.

Forbidden: denial-of-service and load testing; social engineering and phishing; physical access; messages to real users; accessing or changing more real data than needed to show a finding; keeping copies of real data; moving on to systems outside the scope.

6. Data and findings

If testing reveals real personal or confidential data, the Provider goes no further than needed to prove the finding, keeps no copies and tells the Customer the same business day. Critical findings are reported in the chat the same business day. All findings are confidential and given only to the Customer.

7. End of the authorisation

The authorisation ends when the test plan’s window ends or when the Customer withdraws it in the chat. The Provider then deletes the test access within 14 days. This edition applies from 24 October 2026.