Level 3 — Partial Safe Harbor

The policy makes a promise not to pursue legal action against researchers acting in good faith. The key word is promissory — language like “we will not pursue” or “we will not take legal action.” This is where researcher protection begins. However, it stops short of explicitly authorising testing — think of it as “you’re safe to report” rather than “you’re safe to test.” The protection is real but incomplete.

What observers see

• Policy language that commits the organisation to non-pursuit for good-faith research
• Often phrased as “we will not initiate legal action” or “we waive claims against”
• Scope of the promise is sometimes narrow — only reports through the official channel, only current policy adherents, etc.
• Testing itself is NOT explicitly authorised

Researcher protection

Partial. If a researcher reports responsibly and the organisation honors its word, the researcher is protected from action by this organisation. But:

• Third parties (platforms, law enforcement) are not bound
• Anti-circumvention laws (DMCA) still apply
• TOS/AUP violations remain open for action
• The protection often requires the researcher to already have adhered to the policy — a chicken-and-egg problem if testing itself is the question

Path to Level 4

Upgrade the Safe Harbor section to explicitly authorise security testing, and carve out specific exemptions from anti-hacking laws (CFAA, CMA), anti-circumvention laws (DMCA), and the organisation’s own TOS/AUP. See terms/core-vdp.md Safe Harbor section for canonical language.