Rules of engagement for security testing
This is the standard every network member commits to when testing a system: where work may happen, when, what is never done and what happens if something stops. They are public on purpose: anyone commissioning a test can read them first, and any professional can use them as the basis of their own contract. They are a ready-made template: adapt them to each job, its scope and the client's needs.
- Work only where it is written. Only the systems the client has listed in writing are tested. Anything not written is not touched, even if reachable from authorised systems. Connected third-party services — payments, mail, analytics — stay out, unless their provider also gives written permission.
- Work only when agreed. Tests run within the agreed dates and time window, with times written in 24-hour format and the time zone alongside. Nothing runs outside that window. If more time is needed, it is agreed in writing.
- Remote, unless agreed otherwise. Work is carried out over the network, only on the listed systems. On-site presence is agreed separately and in writing.
- What is never done. No tests aimed at taking systems down or slowing them. No data deleted, modified or encrypted. No deceptive calls or emails to staff unless expressly agreed in writing. Load tests or social engineering are agreed separately.
- If something stops, everything stops. If a system freezes or slows down, testing stops immediately and the client's named contact is called; that contact must be reachable for the whole window.
- No weapons handed over. Exploits, ransomware or malware are never handed to anyone or left on systems. Whatever is used to prove a flaw is deleted when testing ends. The client receives what was exposed, how serious it is and how to close it — not the tool used.
- Cryptography is always checked. Every test checks how data and access are protected: keys written into code, outdated protections, expired or misconfigured certificates, weakly stored passwords. A test is not a compliance certification: that is issued by an accredited body.
- What is seen stays confidential. Confidential data encountered during a test stays confidential with no expiry, is not copied out beyond the minimum needed to prove the issue, and is redacted in the report.
- The report belongs to the client. The final document is the client's property. It is not used as a case study, and the client's name appears in no material without written authorisation.
- A backup is recommended. A recent, verified backup is recommended before any test: the risk of testing is never zero. If the client has none, work proceeds with maximum caution and the risk stays with the client, stated in writing.
- What a test is not. A test says what was found within the agreed scope and time. It does not guarantee that the system cannot be breached.
- Whoever authorises must be entitled to. Whoever commissions the test states in writing that they own the systems, or hold the owner's written permission. If systems are hosted by a third-party provider, that provider's permission is also needed.
Financial terms and the contract stay between the member and the client: Boutique Hacker is not a party to the work; it verifies the certifications of those who join and publishes these rules. The template is provided as is: defining the scope, obtaining authorisations and adapting the rules to each job is the sole responsibility of the member and the client. Boutique Hacker is not liable for scope errors, missing authorisations or damage arising from the work performed.