# Authorized application security assessment scope

Provided by WarHoundAI as an editable planning aid. This worksheet is not permission to test a target, legal advice, or a statement that BloodHound assessments are available.

## Authorization
- Target owner:
- Person approving the assessment and their authority:
- Written authorization reference:
- Assessment operator and escalation contact:
- Start/end time and time zone:

## Included targets
List exact approved domains, subdomains, API hosts, paths, and environments.
- Approved targets:
- Approved redirect destinations:
- Explicit exclusions, including third-party providers:

## Identities and data
- Synthetic test accounts and roles (identifiers only, no passwords):
- Tenant/workspace membership rules:
- Synthetic records and disposable fixtures:
- Credential delivery and revocation process:

## Execution limits
- Approved check categories:
- Excluded destructive or expensive actions:
- Request rate and concurrency:
- Payload, duration, and financial limits:
- Network restrictions, including private and metadata destinations:

## Stop conditions
- Unexpected customer data:
- Service degradation or repeated operational errors:
- Out-of-scope destination:
- Owner stop request and method of terminating queued work:

## Evidence and completion
- Permitted evidence, redaction, and access:
- Retention/deletion dates:
- Findings owner:
- Fixture cleanup and access revocation:
- Remediation deployment and retest plan:

References: https://warhoundai.com/blog/authorized-security-testing-scope/ and https://warhoundai.com/guides/