Generation STEM
Learning LibrarySecurity LibraryTeens

Ethical hacking ethics: permission comes first

The single line between a security professional and a criminal is permission. Before any testing, you need written authorization, a defined scope, and a plan to report problems responsibly.

The big idea

Ethical security work requires explicit permission, staying within an agreed scope, and disclosing what you find responsibly — the rules come before any tool.

See it in code

1The basics

Before any security work, one question comes first: is there permission? Without it, the only correct move is to stop:

python
# The first gate: is there permission?
has_permission = False
if has_permission:
    print("Permission granted - you may proceed.")
else:
    print("No permission - stop.")
Run it — no permission means stop, every time:
No permission - stop.

No permission, no action — full stop. Nothing about the target or the tools matters until this gate says yes.

2A step further

Permission alone isn't enough. The target also has to be inside the agreed scope. Both must be true — so a system you weren't hired to test still stops, even with permission in hand:

python
# Two gates now: permission AND the target must be in scope.
scope = ["test.example.com"]
target = "bank.example.com"
has_permission = True
if has_permission and target in scope:
    print(f"{target}: GO")
else:
    print(f"{target}: STOP")
Run it — permission without scope still gets a stop:
bank.example.com: STOP

Permission was granted, but bank.example.com was never in scope — so it's a STOP. Both gates have to open together.

3In our world

Wrap both gates into one reusable check and run several cases through it. It allows a test only when there's permission and the target is inside the agreed scope — anything else returns 'stop', no exceptions:

python
# Before ANY security testing: written permission + defined scope.
def is_authorized(target, scope, has_permission):
    return has_permission and target in scope

scope = ["test.example.com"]
checks = [
    ("test.example.com", True),
    ("test.example.com", False),
    ("bank.example.com", True),
]
for target, permission in checks:
    ok = is_authorized(target, scope, permission)
    print(f"Test {target}? {'YES - in scope, permitted' if ok else 'NO - stop'}")
Run it — only an in-scope, permitted target gets a green light:
Test test.example.com? YES - in scope, permitted
Test test.example.com? NO - stop
Test bank.example.com? NO - stop

Both conditions must hold: permission and in-scope. Testing a system without permission — even 'just to see' — is illegal and harmful, no matter how good your intentions. Real professionals work under a contract, stay strictly inside scope, and report findings privately so they can be fixed.

The same idea, everywhere

Consent, scope, and responsible disclosure aren't unique to hacking. They're the ethics of any powerful skill. A doctor needs consent. A journalist protects sources. A researcher follows a review board. Powerful abilities come with a duty: use them only where you're authorized, and reduce harm.

Try it yourself

Add a rule requiring the test to also be within an agreed time window. Then write down, in plain words, what 'responsible disclosure' means: report the flaw privately to the owner, give them time to fix it, and never exploit it.

The common mistake

Believing good intentions replace permission. Finding a flaw in someone's system without authorization is still a violation, even if you meant to help. If you stumble on a real issue, the right move is to report it responsibly — never to poke further.

What it unlocks

Ethics is the foundation beneath the security mindset and every topic in this library, and its authorization logic uses boolean logic and conditionals.

Related concepts