So if we get consent from a C-level at a company, we don't need consent from every other lower level person we trick? If you have approval from one person in a

So if we get consent from a C-level at a company, we don't need consent from every other lower level person we trick? If you have approval from one person in an org of 100,000 is this still okay? It has to be, because getting explicit consent from every person in the org at that size would be untenable, and make them artificially extra vigilant during a potential audit window. Well now scale this to open source. The typical web project has 2k+ random nodejs libs in their dependency tree. These are all separate orgs/individuals. Real world bad actors are backdooring these projects constantly. I specialize in this area of research. If every white hat has to get permission from exponentially large dependency chains, they will never even come close to being able to compete with black hats here finding the weak links of the chain. The blackhats set the rules of engagement, for better or worse. White hats should be free to go for it just like with any other vulnerability they evaluate.