Permission & scope
I follow each organization's published disclosure policy and test within its stated scope and authorization. I use test accounts and data where available, minimize access, and avoid disrupting services or exposing other people's information.