HUMAN-VERIFIED TESTING CHARTER & GOVERNANCE

Penetration Testing Policy

Operational Standards, Rules of Engagement & Emergency Stop Protocol

LEGAL REVIEW RECOMMENDED: Penetration testing involves active security assessment methodologies. Customer legal counsel and security leadership should review and approve the Rules of Engagement (ROE) and emergency stop protocols prior to executing testing authorizations.

Shieldmix One bridges automated vulnerability intelligence with expert, human-verified penetration testing. Our penetration tests are governed by strict defensive charters designed to identify subtle business logic vulnerabilities while ensuring zero disruption to customer production availability.

1. Rules of Engagement & Testing Authorization

Every penetration test requires a bilateral Rules of Engagement and Testing Authorization agreement signed digitally by authorized customer executives and Shieldmix Operations. This document defines:

Explicitly authorized target endpoints, hostnames, and IP ranges.
Explicitly out-of-scope third-party dependencies, billing providers, and shared infrastructure.
Allowed testing windows, timezones, and rate limits (e.g. maximum 10 requests per second).
Designated 24/7 technical emergency contacts and secure communication channels.

2. Researcher Qualifications & Tenant Isolation

Engagements are assigned exclusively to vetted security researchers holding industry-recognized credentials (such as OSCP, CREST, or equivalent peer-reviewed defensive security credentials).

Researchers operate inside our strictly isolated Pentester Portal (/app/pentester), where they can only view targets and findings explicitly chartered for their assigned engagement. Cross-tenant access is structurally prevented at the database and API layer.

3. Immediate Emergency Stop Protocol

Customer administrators, assigned security researchers, and Shieldmix platform operators hold unilateral emergency stop authority. If target latency increases, anomaly alarms trigger, or unexpected behavior is observed:

A single tap or API call to /api/pentests/:id/emergency-stop immediately halts all active testing traffic, logs an immutable audit event, and alerts all stakeholder contacts.

4. Evidence Security & Attestation

Penetration test findings, proof-of-concept steps, and HTTP artifacts are stored encrypted at rest. Evidence files are accessible solely via signed, short-lived URLs. Upon engagement completion, Shieldmix issues an executive Attestation Letter summarizing the scope, dates, and defensive methodology.