Bottom-up is perhaps the best approach, however. I mean, if an organization doesn't want white hats snooping around, then that's up to them, period. So should b

Bottom-up is perhaps the best approach, however. I mean, if an organization doesn't want white hats snooping around, then that's up to them, period. So should be a matter of more organizations actually putting out some guidelines. Top-down would be important for accidental discoveries though. It's quite problematic to go after someone that accidentally finds an issue in your service.