TTGUnderstand the objective
Discuss your environment, concerns, ownership and intended outcomes. Do not share credentials or sensitive records during the initial inquiry.
SECURITY RESEARCH PROCESS
Deliberate methods.
Defined boundaries.
Good security research starts with permission and ends with clear, actionable evidence. Here is how an engagement is structured.
Define the scope
Document approved assets, access, testing windows, methods, exclusions, contacts and stop conditions in a scoped SOW. Agree confidentiality/NDA terms.
Confirm written authorization
Obtain explicit written permission from an authorized owner or representative before any testing. A contact form submission, NDA or payment alone is not testing authorization.
Assess and validate safely
Follow agreed rules of engagement. Minimize access to data, capture only necessary evidence and pause if testing could exceed scope or create unacceptable disruption.
Report with context
Provide reproducible steps, demonstrated impact, severity rationale, limitations and remediation guidance as agreed. Keep findings confidential; coordinate disclosure only under an agreed plan.
Retest when agreed
Confirm fixes within a separately agreed retest scope and window. Record what was checked and any remaining limitations.
Permission can change. The work must follow.
If authorization is withdrawn, a stop request is received, or scope becomes unclear, testing stops until the appropriate written authorization is restored.
START WITH A CONVERSATION