Swiss National Cyber Security Center (NCSC.ch)

While testing

• Do not discuss the security vulnerability you have discovered with anyone other than the affected vendor, the respective system owner and the NCSC during the coordinated disclosure process.
• Do not publicly disclose the vulnerability until the affected parties have been given enough time to remedy it, or until you have reached an agreement with all the parties including the NCSC.
• Once you have reported a vulnerability to the NCSC, do not repeatedly interact with the affected system during the coordinated disclosure process.
• Do not leverage vulnerabilities to download, modify or delete any data beyond the minimum necessary actions to provide a proof of concept.
• Do not attempt to elevate privileges, or explore a system beyond the minimum necessary to provide a proof of concept.
• Do not exfiltrate other users' data, use only your own account(s) for testing.
• Do not attempt to gain access to a system using brute force or social engineering techniques.
• Do not use denial of service attacks.
• Do not install malware or viruses.
• When possible, specify in your report what IP addresses you were using when you discovered the vulnerability, this will help assess potential exploitations and reducing false positive alerts.