A useful test is authorised, bounded and traceable.
1. Free scan
The free scan is limited to passive external analysis of the declared domain. It performs no exploitation, brute-force, authentication bypass, load generation, data modification or internal-network testing. By starting it, you confirm that you control the target or have sufficient authority.
2. Active or authenticated engagement
Before active or authenticated analysis, AxiSecurity requires ownership verification or a mandate from the legitimate owner, a written scope, included and excluded environments, a testing window, emergency contacts, rate limits and a stop procedure. Pre-production environments are preferred where they meet the objective without disproportionate risk.
3. Default prohibitions
Without specific written agreement, the following are excluded: denial-of-service, saturation, phishing, social engineering, destructive exploitation, deletion or modification of data, bulk collection, attacks on third parties, out-of-scope pivoting and use of credentials not supplied or authorised.
4. Stop and reporting
The customer may ask to stop an engagement through the channel defined in the mandate. AxiSecurity may also stop any action that risks availability, integrity, confidentiality, physical safety or legal compliance. Critical observations are escalated under the agreed process.
5. Reporting
Deliverables specify scope, limits, techniques, useful evidence, risks, recommendations and, where agreed, conditions for retesting. Results must be treated as confidential security information.