Authorized means written down

Every security engagement I take starts the same way. A written scope that names the systems, the techniques, and the window. Not a verbal ok on a call. A document both sides can point at later.

Nothing starts on a call

A call is useful for tone. It is useless as authorization. People remember different sentences. Legal remembers none of them. If the work later has to be explained to a founder, a counsel, or a bug bounty platform, 'we talked about it' is not a record. The record is a document with names, URLs, IP ranges if they matter, excluded systems, allowed techniques, and a start and end. Both sides keep a copy. Then the work can start.

I will not begin recon before that document exists. Curiosity is not authorization. A public signup form is not authorization. A friend forwarding a URL in chat is not authorization. If you need that energy, look elsewhere. The FAQ on this site is blunt about it because I am tired of being asked to 'just have a look' at a production box that belongs to someone who did not write me an invitation.

What the document has to name

The systems. The techniques I may use. The techniques I may not. The window. The severity scale we will use when a finding lands. The channel for critical reports, which is never 'wait for the final PDF'. The rule for out-of-scope discoveries: stop, write it down, do not keep pulling that thread until someone expands the scope in writing. If a credential appears in a screenshot, it gets rotated, it does not get reused as a party trick.

I quote in writing after I understand the blast radius. If the quote is wrong for you, we stop there. No retainer hiding in the weeds, no 'discovery phase' that is actually the engagement without a scope. I work inside existing repos more often than I rewrite them. The rewrite is the job only when the rewrite is the job.

How the Publive work ran

The Publive engagement is the one I will name, because it was authorized, scoped, and reported in the open enough to be useful as an example. Scope first. Then recon against what the document allowed. Findings written up as they landed, each with reproduction steps and impact stated plainly, in language a product person could read without a decoder ring. Critical bugs were reported the day they were confirmed. They were not saved for a dramatic final report. A final report that sits on a finding for two weeks so the narrative lands better is a vanity document. I will not write one.

I am not going to publish those bugs here. This is not a writeup of someone else's production. It is a writeup of the method. The method is the thing you can reuse. The bugs belonged to Publive the moment they were confirmed, and they were told the same day.

A bug outside scope is a liability

People treat extra bugs as generosity. They are not. A finding on a system you were not asked to touch is an uninsured action. It can become a disclosure problem, a relationship problem, and in the worst case a legal problem, even if your intent was clean. I do not hunt friends, family, or random production boxes. I do not 'help' by continuing past the edge of the page. If I trip over something adjacent, I stop, I describe it without proof-of-concept theater, and I wait for a written expansion. If the expansion never comes, the note stays in the report as out of scope and I leave it alone.

That rule is how I sleep. It is also how I keep being allowed to do this work. Authorized security research is a small door. Walking through it without the paper is how people get the door closed on them, and on everyone else who does this carefully. I would rather leave a finding on the table than create a liability that the scope never covered.

If you want the work

Email zentex@warm.run. Put the problem in the first paragraph. Links beat PDFs. I will answer in writing: a scope, a no, or a few sharp questions. No intro call required. If I cannot help, I say so. If I can, nothing happens until the invitation exists on paper. Then I am happy to break things carefully.

Kashmir, IST, async by default. I build warm.run and routing.run in the same weeks I take this work, so I am selective. Selectivity is not a brand. It is how the scope stays honest. If that is too slow for you, there are firms with twenty people and a slide deck. I am one person with a terminal, and the paper comes first.