Rules of engagement

These rules apply to every test we run. They exist so you know exactly what to expect, and so nobody is ever tested without consent.

Authorization first

• No testing starts without written authorization from someone entitled to give it for the systems in scope.
• The authorization names the applications, hosts, builds and accounts in scope, the testing window and an emergency contact on your side.
• If you don't own the system (for example a vendor product you use), you obtain the owner's consent before we begin. We can help you ask.
• The free exposure check follows the same rule: you confirm ownership or authorization when you request it.

What we do

• Analyse the builds you ship (web bundles, mobile packages, installers, contracts) with the same tooling an attacker would use, including AI-assisted reverse engineering.
• Test authentication, authorization, input handling, business logic and configuration against the systems in scope, within the agreed window.
• Use test accounts and test data you provide where possible, and stop if we encounter real customer data we weren't expecting.
• Record evidence for each finding so you can reproduce and verify it.

What we don't do

• Test anything outside the written scope, or for anyone who can't show they are authorized.
• Run denial-of-service attacks or anything designed to take a service down.
• Exfiltrate, keep or share customer data beyond the minimum needed to demonstrate a finding, and never outside our team.
• Help anyone copy, clone or attack a product they don't own. We decline those requests.

Findings

• Critical findings that put live data or money at immediate risk are reported to your emergency contact as soon as we confirm them, before the report.
• All findings go to you and nobody else. We don't publish or disclose them without your written permission.
• We keep engagement materials only until the work is delivered and supported, then delete them.

Questions

Email info@qubitronlabs.com. If you believe one of our tests touched a system you own without authorization, contact us immediately at the same address.