Pen Testing Legal Hub
Authorization agreements, safe harbor law, Van Buren analysis, Flipper Zero liability, VDP scope limits, and state law overlays — everything a pen tester needs to stay on the right side of CFAA.
Practitioner Templates
Full legal agreement covering parties, scope, IP ranges, timing, rules of engagement, data handling, insurance, indemnification, confidentiality, and governing law. Customize sections 1, 3, 5, and 10 per engagement.
Essential Modules
Bug bounty programs and vulnerability disclosure policies tell you which systems to test, but they do not immunize you from criminal prosecution — that power be…
The Flipper Zero is a legitimate multi-protocol security research tool that can also be a federal crime instrument in under thirty seconds depending on the targ…
This post explains the main federal anti-hacking law in plain English. The key modern question is whether someone broke into a part of a computer system they we…
Bug bounty work is not automatically legal just because it improves security. The safest protection comes from written permission through a bug bounty or disclo…
Activity Risk Matrix
| Activity | Risk Level | Controlling Statute | Mitigation |
|---|---|---|---|
| Port scanning target in scope | Low — standard recon | CFAA § 1030(a)(2) | Document scope letter before starting |
| Fuzzing authenticated endpoints | Low — if scoped and authorized | CFAA § 1030(a)(2) | Stay within authenticated session only |
| Auth bypass / privilege escalation | Medium — collect min proof only | CFAA § 1030(a)(2) | Screenshot + stop; don't exfiltrate real data |
| Extracting real PII as PoC | High — even with authorization | CFAA + GDPR Article 33 | Use synthetic data; never copy real PII |
| Testing third-party systems via target | High — almost never in scope | CFAA § 1030(a)(2)/(a)(5) | Get explicit written authorization for each system |
| Public disclosure before patch | High — DMCA + CFAA exposure | 17 U.S.C. § 1201 | Honor 90-day window; follow CVD process |
| Flipper Zero on target RF systems | Medium–High | CFAA + FCC § 333 | FCC jamming is strict liability — no defense |
| BadUSB / HID injection in scope | Low if authorized | CFAA § 1030(a)(5) | Scope letter must explicitly name physical attacks |