Rules of Engagement & Non-Production Scope Authorization

Version 2026-11-01

By confirming authorized scope, you attest that you own the target or have written permission from its owner covering automated penetration testing, source analysis, the named hosts and repositories, and the scheduled testing window.

Use acceptance, staging, preview or development environments isolated from production. Production apex, www, api, prod and production targets are refused. A hostname label alone does not establish isolation: use test data, test payment keys and restricted credentials.

The allowed scope consists only of enrolled repositories and verified non-production hosts. Third-party integrations and production APIs are excluded unless separately authorized and safely isolated. Gate credentials are used only for the declared environment.

No deliberate service disruption, destructive data changes, exfiltration beyond minimal evidence, persistence, social engineering or movement to unrelated systems is authorized. Stop testing if ownership changes, a production canary blocks the target, or adverse effects occur.

Enrollment records the account, timestamp and terms version. Keep written authorization and emergency contacts available. Revoke ownership and cancel runs immediately when consent ends. Report scope or safety incidents to security@rattle.fyi.