Reading a program policy.

Before touching anything: read the scope (which domains/apps/assets), the out-of-scope list, the rules (no DoS, no automated flooding, no social engineering), and the reward table. The policy is a contract — internalise it.