EARLY ACCESS · NOVEMBER 2026

Useful evidence. Responsible review.

These standards describe the proposed service. They do not create permission to test a third party or replace a signed engagement.

Agree the scope

List exact assets, the system owner, test accounts, methods, request limits, testing window, and emergency contact. Approval from a website customer does not automatically authorize testing its hosting or software vendor.

Collect the minimum

Prefer synthetic data and dedicated accounts. Keep credentials separate from evidence. Stop on unexpected access to another person’s data, unintended state changes, or availability effects.

Make claims traceable

• Confirmed issue: reproducible security failure and specific impact.
• Needs validation: observation or hypothesis without demonstrated impact.
• Control held: the tested action was correctly prevented.
• Not tested: outside scope or unavailable in the environment.

Use AI with review

Models can analyze sanitized evidence and propose fixes within approved access. Human review checks claims. A local demonstration is labeled as a local demonstration. Model access is not permission to test a system.

Close the loop

Document a correction for each confirmed issue and agree a retest. Reports state the limits of the work. Vendor disclosures and public case studies receive a separate review before release.