Rules of Engagement & Responsible Use

PentestHub AI is a tool for authorized security testing. This page is a practical summary. The binding rules are in the Terms of Service and the Acceptable Use Policy.

Before you test

• Own it or have it in writing. Test only assets you own, or for which you hold explicit, written and current authorization from the owner: a contract, signed Rules of Engagement (ROE), or a bug bounty program's published scope and safe-harbor terms.
• Know your scope. Write down the exact assets, the time window, the allowed techniques and the contacts for emergencies.
• Record the basis in PentestHub AI. Each target asks how you are authorized and for an expiry date. Keep it accurate.

While you test

• Stay inside the authorized scope, time window and methods. If something looks out of scope, stop and ask.
• No denial-of-service or load testing without explicit written permission.
• Collect only the minimum proof of concept. Do not download, change or delete data beyond what proves the issue.
• No social engineering or phishing of people who did not agree to it.
• Do not test third-party services just because the target uses them (for example its payment, email or cloud provider) — they need their own authorization.
• Critical infrastructure, government and military systems require explicit written authorization from the responsible authority. The hosted service blocks some of these by default.

If something goes wrong

• If you accidentally access personal or sensitive data, stop, do not keep a copy, and tell the asset owner.
• If you cause an outage, stop testing and contact the owner immediately.

Your responsibility

PentestHub AI provides tooling. It does not verify your authorization on your behalf. If you test without authorization or outside the agreed ROE or scope, you act at your own risk and are fully responsible for the legal consequences in your country and in the country where the target is located.

Questions: support@pentesthubai.com.