Prove the right to test
Obtain authorization from the asset owner or authorized representative before beginning.
- Named systems and responsible parties
- Approved timeframe, access and techniques
- Documented exclusions and restrictions
Operating principles
The boundaries are part of the work.
AMYNA frames security assessment around written permission, proportionate techniques, evidence accountability, and clear stop conditions. These principles describe the engagement standard we seek to uphold.
Rules of engagement
Authorized by design.
A well-defined mandate makes it possible to investigate real risk without creating unnecessary operational harm.
Minimize disruption
Match activity to risk, use isolated validation where possible, and provide defined escalation paths.
- No out-of-scope targets
- No uncontrolled persistence or exfiltration
- Pause or stop when conditions require it
Maintain human judgment
Technical outputs and potentially high-impact actions warrant review by an accountable person.
- Reviewer and owner of findings
- Traceable evidence and decision context
- Responsible disclosure and handover
Operational controls
From mandate to closure.
1. Scoping & authority
Before testing, identify the client’s authorization, target inventory, exclusions, operating window, emergency contacts, success criteria, and approved techniques. Changes require renewed agreement.
2. Safe testing & escalation
Separate laboratory validation from live operations where practical. Require human review for potentially disruptive steps. Maintain the ability to stop work and promptly escalate unexpected impact.
3. Malware & digital evidence
Analyze samples that may lawfully be held and examined. Use appropriate isolation and access controls; maintain provenance and chain-of-custody expectations where relevant to forensic work.
4. Reporting & remediation
Provide defensible findings, impact context, recommendations, and an agreed disclosure route. Limit distribution of exploit details and confidential evidence to authorized recipients.
5. Client data & AI tools
Agree on what data may be processed and by which tools before use. Minimize sensitive content, respect confidentiality, and keep any approved Daybreak capabilities restricted to internal authorized personnel and approved environments.
Non-negotiable limitsNo mandate.
No mandate.
No test.
We do not consider a vulnerability claim, internet visibility, or a tool capability to be permission to access a target. External systems, client data, and advanced AI access remain subject to explicit authorization and applicable policies.
Security research is not a blanket exception.
AMYNA’s published scope is a statement of intended professional conduct, not a promise of unrestricted testing, a public bug bounty, or automatic permission to probe amyna.cy. For website vulnerabilities, see our coordinated disclosure guidance.
Responsible AI
View Daybreak readiness AI augments analysis. It does not grant authority.
AMYNA is preparing a request for organization-level Daybreak Red access for internal authorized security workflows. Proposed controls and use cases are described transparently in a separate application-use statement.
TRANSPARENCY NOTE
Application status
Daybreak Red approval has not been received or implied. Described AI-specific controls are proposed measures for review and must be implemented and verified before operational use if any access is approved.
Authorized engagements
Discuss security work responsibly.
Email or call AMYNA to discuss a lawful scope and arrange an appropriate channel for sensitive information.