We attempt to use weaknesses the way an attacker would — inside an agreed scope, window and rule set. Findings are reported with severity and recommended fixes.
Authorization
No test starts without explicit written authorization. Out-of-scope systems are not touched.