Responsible Testing Model

Responsible testing starts before any request is sent.

Step 1: Confirm Authorization

Write down the program, lab, toy environment, or permission source. If you cannot name the permission source, do not test the system.

Step 2: Confirm Scope

List what is allowed, what is out of scope, and what actions are explicitly disallowed. Treat unclear scope as a stop sign.

Step 3: Use Tester-Controlled Accounts

Use only accounts and objects that you created for the test. Do not access third-party data, even if it appears reachable.

Step 4: Minimize Impact

Prefer read-only checks first. If a state change is needed, make it reversible, small, and allowed by scope.

Step 5: Define Stop Conditions

Stop immediately if private third-party data appears, a flow reaches payment completion, the test would send repeated notifications, or the next step would require guessing identifiers or secrets.

Step 6: Handle Evidence Carefully

Capture only the minimum proof needed. Redact before storing or sharing. Keep private evidence outside this public repository.

Step 7: Disclose Responsibly

Submit only through the authorized disclosure channel. Be precise about impact, limitations, and the safe boundaries used during testing.

For AI-assisted work, pair this model with the AI-OS Safety Contract and AI-OS Decision Gates.