Is gathering up the credentials of employees not also a privacy violation? At this point you&#x27;re going way beyond proving that you have access to something - you&#x27;re actively trying to probe and see how deep the rabbit hole goes. I don&#x27;t (personally) believe that this is acceptable behaviour under a white hat program.