Keep testing within your authorization
Use only accounts, systems and information you are authorized to test. Do not access another person's records, disrupt availability or publish a working exploit against a live service.
A useful report identifies the affected feature, the expected result and the steps that produced the problem. Preparing a report is not authorization to conduct testing and does not establish bounty eligibility or reward terms.