Why scope fails
Weak scope language creates a gap between what the company thinks it allowed and what the researcher thinks is fair game. That mismatch wastes time, creates duplicate work, and makes every submission harder to review.
- List assets by pattern, not only by name.
- Mark exclusions clearly and explain why they are excluded.
- Call out sensitive actions, rate limits, and prohibited testing methods.