Rules of engagement

NSO performs authorized security assessments (reconnaissance, port scans, web-app scans, vulnerability scans, container/image scans) against customer-owned assets. These rules define what is permitted, what is prohibited, how the customer authorizes the work, and how findings are handled.

• Assets in scope: only assets listed on /assets with status Verified or explicit admin bypass.
• Ownership proof: every domain must complete the DNS TXT handshake (_nso-verify or root TXT) before scanning. See DNS verification — why we ask.
• Third-party assets: SaaS, managed services, and shared-hosting IPs require the customer to hold direct written authorization from the operator. NSO will not scan third-party infrastructure on verbal claim alone.
• Out of scope by default: production databases, phone systems, ICS/OT devices, medical devices, and any asset the customer flags fragile.

• Non-authenticated network discovery (Edge, Nmap).
• Vulnerability detection (Nuclei, Trivy).
• Passive web scanning (ZAP baseline).
• Active web scanning (ZAP full) — only after written per-engagement approval.
• Rate-limited, chunked scans respecting per-tenant quotas.

• No exploitation of discovered vulnerabilities beyond safe proof-of-concept.
• No credential brute-forcing, password spraying, or account lockout attempts.
• No DoS, DDoS, resource-exhaustion, or amplification tests.
• No social engineering, phishing, or physical intrusion.
• No data exfiltration; findings capture metadata only, never full payloads.
• No pivoting into networks that are not explicitly in scope.

• Primary channel: the NSO dashboard plus the customer’s designated security contact email.
• Critical finding: notified within 24 hours of confirmation.
• Suspected active compromise: notified immediately via out-of-band channel provided at contract signing; scanning is paused pending customer instruction.
• Emergency stop: the customer can pause all scans at any time from /scans; NSO will honor the pause within 60 seconds.

• Scan results are tenant-scoped and protected by row-level security.
• Raw reports may be stored in an NSO-managed bucket or a customer-owned S3/R2/MinIO sink (see Settings → Storage).
• Recovery codes and MFA secrets are hashed and never exported.
• All privileged actions are logged to /settings/platform-audit.

These rules evolve with the platform. Every change is versioned in the changelog. Material changes require acknowledgement from the customer’s security contact before the next scan.