A county web login form will be tested with carefully limited credential attempts under the rules of engagement. What constraint remains non-negotiable?
Select an answer to reveal the explanation.
Short Explanation
Having the login URL in scope is not a blank check to lock every civic account before lunch. Web forms still sit behind lockout and uptime rules. Spray carefully, count attempts, and keep availability in mind — that is RoE living in the real world.
Full Explanation
Authorized credential testing against web authentication forms remains bounded by account lockout policies, rate limits, and availability expectations documented in the rules of engagement. Naming a URL in scope does not authorize unbounded spraying or lateral reuse against unrelated tenants. SSH-only lockout myths do not apply. Professional web auth testing balances evidence needs with operational safety.