Legal & Operational Boundaries

Rules of Engagement (RoE).
Explicit Authority. Zero Surprises.

Offensive security is effective only when bounded by clear legal authorization, transparent scope definitions, and failsafe operational boundaries. We never send an offensive packet without executed mutual consent and strict exclusion enforcement.

Legal Foundation

Mutual Authorization & Ownership Verification

Before any testing initiates, target assets undergo cryptographic ownership verification.

1. DNS Ownership Token

Clients add a temporary unique DNS TXT verification token (e.g. htx-verify=sec-auth-987...) to the root domain to prove ownership.

2. IP & Cloud Allocation Proof

For cloud and dedicated IP ranges, verification occurs via reverse DNS (PTR), signed AWS/GCP letter of authorization, or tenant console screenshot.

3. Executed Written Consent

Both parties execute a bilateral Rules of Engagement contract explicitly defining authorized testing windows, originating source IPs, and escalation contacts.

Operational Invariants

Permitted Actions vs. Strict Exclusions

Clear rules governing what our operators and autonomous pipelines are authorized to do.

Category	Authorized Actions (Within Scope)	Strictly Excluded Actions (Prohibited)
Denial of Service (DoS)	Low-rate API fuzzing, concurrency checking with strict rate limiting.	PROHIBITED: Volumetric traffic flooding, resource exhaustion attacks, packet amplification, stress testing.
Data Handling	Capturing benign evidence tokens (e.g. proof files, masked hashes, non-sensitive metadata).	PROHIBITED: Exfiltrating customer PII, copying production databases, altering client records, downloading proprietary IP.
Target Scope	Explicitly listed domains, APIs, and cloud resources named in the RoE.	PROHIBITED: Third-party shared services (AWS console, Stripe, GitHub, Cloudflare), unapproved partner integrations.
Exploitation	MFA-gated proof-of-concept execution demonstrating exploitability safely.	PROHIBITED: Destructive payload execution, overwriting production binaries, deploying unapproved persistence backdoors.
Social Engineering	Passive exposure analysis of public employee footprints (OSINT only).	PROHIBITED (Unless Scoped): Phishing client employees, credential harvesting campaigns, physical office intrusion.

Fail-Safe Controls

Emergency Stop & Kill-Switch Protocols

Immediate mitigation procedures available 24/7 during active testing windows.

• Instant Kill-Switch: Every client is provided a dedicated 24/7 hotline and a direct emergency webhook. Triggering the kill-switch halts all testing traffic across all originating worker nodes within 60 seconds.

• Dedicated Source IPs: All assessment traffic originates from a static, pre-communicated block of Hydrenyx Security testing IPs, allowing your defensive team to isolate and correlate testing events in real time.

• Zero Artifact Left Behind: Upon engagement completion, any temporary test accounts, non-destructive evidence tokens, or benign diagnostic files are completely cleaned up and verified with your engineering team.