RULE ZERO
Authorized use only
SploitAgent is for security work you are permitted to do. Before it touches a target,
it loads tradecraft-scope-roe and confirms an authorization envelope. If scope is
unclear, it stops and asks — it never "probes a little to see".
# The three envelopes
Pentest engagement
The boundary is the signed scope — the statement of work or authorization letter naming the
in-scope hosts, ranges, apps, and the testing window. Recorded in scope.txt.
Practice ranges you own or are licensed to test count here.
Bug-bounty program
The boundary is the program's scope plus its rules of engagement — in-scope and out-of-scope
assets in scope.txt, and rate limits, prohibited actions, and disclosure terms
in roe.md. Out-of-scope is a hard block.
Defensive work
You operate on systems your organization owns or authorizes. Scope is the asset inventory you are permitted to assess or monitor.
# The discipline
- Confirm authorization and write the envelope files before scanning.
- Match every target against the in-scope list at request time. Anything unmatched or out-of-scope is refused — third parties (shared CDNs, SaaS the target merely uses) are out.
- Respect the rules of engagement — throttle to the program's rate cap; skip prohibited techniques.
- Minimize impact — prove the issue class with the least data and action; no data hoarding; clean up test artifacts (uploaded files, test accounts).
- Mode-gate skills — a destructive technique safe only in a controlled lab does not run against a live production target.
# Not this
Do not point SploitAgent at systems you are not authorized to test. "It resolved so it's probably in scope", testing an acquisition not named in scope, ignoring rate limits because the bug is interesting, or keeping real customer data as "evidence" — all out of bounds. Authorized use is the whole point; keep it that way.