> 3. A clear statement that we consider actions consistent with the policy as constituting “authorized” conduct under the Computer Fraud and Abuse Act (CFAA).

> 3. A clear statement that we consider actions consistent with the policy as constituting “authorized” conduct under the Computer Fraud and Abuse Act (CFAA). That's hugely important if you want bug bounty programs to appeal to people who are distrusting of federal prosecutors and the FBI. Without it, there's a lot of anxiety and uncertainty with testing live systems.