Information handling
Information requested for an engagement should be limited to what is needed for the agreed work. Classification, transfer method, storage location, permitted access, retention and secure disposal should be agreed before sensitive material is exchanged.
Do not send passwords, private keys, recovery codes, tokens or sensitive configurations through ordinary email or a public website interaction. An approved restricted exchange method can be arranged when the work requires sensitive evidence.
Administrative access
Read-only, time-limited and task-specific access is preferred where practical. Access should be approved by the system owner, protected with appropriate authentication, attributable in available logs and removed or reviewed at closeout.
An assessment does not automatically authorize remediation or production access. Shared everyday administrator accounts should be avoided.
Production change safeguards
Authorized production work should have a named owner, approved window, validation plan, monitoring, stop conditions and rollback. Scope and command authority should be explicit before execution.
Potentially disruptive testing should use non-production systems or an approved maintenance path where practical. Production logging must not be interrupted solely to test collection.
Website and diagnostic tools
The public diagnostic tools are designed for bounded checks and do not intentionally store submitted lookup values in an application database. Standard edge request logs and third-party network responses may still apply.
Do not submit private hostnames, credentials, tokens, confidential configurations or information you are not authorized to test. Tool output is informational and should be validated before operational decisions.