SolarWinds

While testing

• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
• Only use exploits to the extent necessary to confirm a vulnerability.
• Do not use an exploit to compromise or exfiltrate data, establish command line access and/or persistence, or use the exploit to “pivot” to other systems.
• Keep confidential any information about discovered vulnerabilities.
• Do not exploit identified vulnerabilities in a manner that risks the confidentiality, integrity, and/or availability of any resources not explicitly owned by you during testing processes.
• Do not use your findings to phish, spam, social engineer, or otherwise defraud any customers or SolarWinds employees while testing to gain more access.
• Do not try to physically access SolarWinds properties, attempt to social engineer employees, or otherwise try to discover risk beyond digital means against SolarWinds.
• Do not perform denial of services (DoS) or distributed denial of service (DDoS) attacks against any SolarWinds resource to prove an impact for a suspected security issue.