"If any pentester would download more data than necessary to prove a bug exists, they would be fired." I disagree, sticking to that would even be foolish in a

"If any pentester would download more data than necessary to prove a bug exists, they would be fired." I disagree, sticking to that would even be foolish in a full scope pentest. It depends what the data is. I would, and have, download any data of operational value using a bug that was found. If I can dump the entire company's employee password hashes, I'm going to. And after the engagement, a company-wide email is going out to roll those credentials, which, whether I personally viewed them or not, are now considered compromised. There are some exceptions if there is reason to have high confidence that no one else ever exploited the bug, but that's taking a big chance. Data of no operational value would be difficult to explain, and customer data or credentials would be off limits beyond proving the bug. Even though it's likely legally fine in most cases (note: a work-for-hire contract or an internal pen test team have very different rules of engagement than bug bounty spec work), it would be highly unprofessional. You're going to be putting the customer in a very awkward position at best. But if you're hired to perform services on behalf of the company, breach disclosure laws don't apply any more than if you are hired as a contractor to migrate their database from one system to another.