Unverified50% confidenceDecision RuleExact time
Compliant testing practices include: testing only within the asset scope explicitly published on the SRC platform, complying with platform prohibitions (such as no destructive testing and no database dumping), not touching user privacy data, and promptly reporting discovered vulnerabilities through official channels while retaining test records.
1
Sources
50%
Confidence
Long-term
Relevance
10/31/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedDifferent SRC platforms differ in their vulnerability rating standards, reward ranges, and testing boundaries, and beginners are usually advised to start with the testing scope publicly stated by the vendor.77% similarUnverifiedSRC bug hunting is legally authorized testing; the scope of vulnerabilities and testing rules are clearly defined by the platform or vendor, and operations beyond the scope may violate the law.76% similarUnverifiedThe core difference between SRC bug hunting and penetration testing is: SRC usually targets real production environments, testing must be within the authorized scope, and it emphasizes the real harm and reproducibility of vulnerabilities.75% similarUnverifiedPermission testing should be as important as functional testing; specific practices include denying new tools by default, requesting one-time write permissions at runtime, recording break-glass accounts, and re-certifying Agent permissions every quarter.74% similarUnverifiedBefore testing against real SRC targets, the stability and accuracy of the AI workbench should first be verified in test ranges (such as DVWA, VulnHub, and OWASP Juice Shop) to avoid false positives and compliance risks.74% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1119199API
curl https://kongchang.com/api/v1/knowledge/claims/1119199MCP
get_claim(id=1119199)