Safety / Written scope

Write the scope. Then start testing

Bypass Labs starts active testing after the owner, targets, methods, evidence limits, dates, and contacts are agreed in writing.

Security contact guidance ↗

Authority

Name the organization that owns each system and the person authorized to approve testing. Third-party hosted or connected systems require their owner’s permission too.

Targets

List domains, applications, APIs, infrastructure, mobile or desktop builds, accounts, environments, and explicitly excluded systems.

Methods

Agree allowed techniques, request rates, authentication roles, data-changing actions, social engineering exclusions, and production constraints.

Evidence

Define how far proof may go, what data may be retained, where it may be stored, and which actions require human review.

Timing

Set start and end dates, testing windows, release freezes, monitoring expectations, and emergency stop conditions.

Contacts

Name test supervisors, system owners, escalation contacts, and the people authorized to pause or change the scope.

NO IMPLIED PERMISSION

A beta request, vulnerability report, product demo, or public page does not authorize testing

Without a written agreement, stop after the minimum evidence needed to explain a possible issue safely and contact the system owner.