To your point in #2: this can create a murky and risky situation for the party being reviewed. Particularly if you’re small and you are trying to land your firs

To your point in #2: this can create a murky and risky situation for the party being reviewed. Particularly if you’re small and you are trying to land your first big client that asks questions like “have you previously been compromised?” then your answer now depends on the definition of compromised. Even if you are engaged in legitimate security research, it is highly unethical and unprofessional to willfully exceed your engagement limits. You may not even know the full reasoning of why those limits are established.