I agree. If there&#x27;s no clear rule &quot;all data stays in our network&quot;, dumping data is not an unreasonable move. I don&#x27;t care whether some experts in their offices mull about what&#x27;s alright to do in a pentest or when finding vulnerabilities for a bounty program - most people aren&#x27;t experts in that sector, so better make it clear. The researcher is in the right here.