I will do vulnerability assessments and penetration testing of your system

No. I follow controlled, non-destructive testing methods and always agree on a testing window and rules of engagement beforehand. For anything potentially risky (e.g., DoS-style tests), I'll ask for explicit permission first or exclude it from scope entirely.

Staging/test environments are strongly preferred to avoid any risk to live users or data. If only production is available, I'll take extra precautions and clearly outline the risks with you before starting.

Just your target URL(s) or IP range, written authorization confirming you own or have permission to test the system, and any relevant context (tech stack, login credentials for authenticated testing, specific areas of concern).

Only if you want authenticated testing (testing what a logged-in user can access/exploit) — this is highly recommended since many real vulnerabilities only show up post-login. Unauthenticated testing is also available but covers less ground.

A detailed report including an executive summary (for non-technical stakeholders), technical findings with CVSS severity ratings, proof-of-concept evidence for each vulnerability, and clear remediation steps.

Absolutely. I'm happy to sign an NDA before any work begins, and all testing data/evidence is securely handled and deleted or returned per your request after the engagement.

No ethical tester can promise that — security is ongoing, not a one-time fix. What I guarantee is a thorough, honest assessment of your current risk and clear guidance to significantly reduce it.

Yes, as long as you own the system or have explicit written authorization to test it. I require this confirmation before any engagement begins — it protects both of us.