First off, I have to admit to a bit of snark when writing that up yesterday tbh and completely forgot about folks reporting some Nessus output etc. I'm absolute

First off, I have to admit to a bit of snark when writing that up yesterday tbh and completely forgot about folks reporting some Nessus output etc. I'm absolutely with you when it comes to that type of automated tool and reporting, thanks for separating that. The Uber one is actually a great example of wording I can appreciate. I was thinking of one like Verizon Media's ( https://hackerone.com/verizonmedia https://hackerone.com/verizonmedia ). > Do not use automated scanners/tools - these tools include payloads that could trigger state changes or damage production systems and/or data. Unlike Uber's that's just a blanket statement and while I'm sure nobody wants to use it in that way (I actually like H1 acting as proxies for that alone, they surely mean something very similar to the example you posted), it's unrealistic and could make pretty much any attack ineligible. All that being said, at least the change to H1s own policy let's people know where they draw the line. Maybe I should change my mind, not every program has to be relevant to everybody at the end of the day.