medlearn.academy

1. Do not perform denial-of-service (DoS) attacks. 2. Social engineering attacks against employees are strictly prohibited. 3. Physical security testing is out of scope. 4. The bug-hunter is allowed to use AI scanners. 5. Allow system access if bug-hunter finds an RCE through file upload or any vector. 6. The website owners / company explicitly REQUESTED the courses data extract as part of the PoC proof. This is considered normal practice for their bug bounty program and they are fully aware. 7. CONDITION: If ALL courses data is successfully retrieved, it MUST be included / attached in the final security report as evidence.