Before any test

Scope and authorisation form

We fill this in together and both sign it before I test anything. Copy it into a document, or I’ll send it to you on Upwork. If it isn’t signed, I don’t start.

1. Who is authorising the test

• Your name, company and role.
• Confirmation that you own the app, or have written permission from its owner, to have it tested.
• Third-party services in the stack (for example Supabase, Stripe, an AI provider): I test only your configuration of them, never the provider’s own systems.

2. What is in scope

• Repository or repositories, and the branch or commit I review.
• The environment I test against: staging or a copy of your app.
• If you only have production: the read-only checks we agree on, and the time window for them. Nothing that writes data, sends email or charges a card.
• Test accounts you create for me, one per role.
• Anything explicitly out of scope.

3. Timing and price

• Tier and fixed price, as booked on Upwork.
• Report due 3, 5 or 7 days, by tier, counted from when I have access and this form is signed.
• One recheck within 14 days of delivery is included.
• Fix work, if you want it: $40 an hour, with no warranty beyond the recheck.

4. How I handle your access and data

• AI coding tools only if you say yes here, only after I scan the repository for secrets, and never with customer data.
• I remove my access, and delete my copies of your code and credentials, within 7 days of delivering the report.
• I keep the report for 12 months so I can answer questions and run the recheck, then delete it.
• NDA on request.

5. Stop conditions

• If I find live customer data exposed, I stop testing that area and tell you.
• If a test could affect real users or payments, I ask before running it.

Signed by both of us, with the date. Back to the start.