It's important before beginning an engagement to closely read the rules of engagement (sometimes also called a code of conduct) to understand the bounds of what is accepted within the program.
The Rules of Engagement lay out:
- What techniques are allowed in the source of testing
- What sites/domains/apps are open to pentesting
- What parts (if any) of those apps are excluded from testing
- What vulnerabilities merit the highest payouts
- What vulnerabilities will not receive a payout at all
- What credentials/account you should use as a security researcher (for a social network or something with authentication-restricted pages, companies will often offer pentesters a path to creating an account they can use to test user-restricted functionality)
The RoE are extremely important not just because they affect your ability...