Authorized security testing policy

Authorized testing

Written scope and authorization are required before security testing. By default exclude DoS, destructive actions, real merchant/customer data, social engineering, third-party providers, production, and unapproved cloud systems. Use local fixtures or an explicitly assigned test environment.