---
name: program-scope-normalization
description: Normalize a live bug bounty brief into a dated scope snapshot, exclusions, operating limits, and an ambiguity queue before authorized testing.
---

# Program scope normalization

## Accepted inputs

- Current canonical program brief URL and retrieval time
- Included and excluded assets, wildcard rules, vulnerability exclusions, rate limits, and data rules
- Researcher account or environment restrictions

Do not infer authorization from an aggregator, search result, old report, or cached copy.

## Procedure

1. Record the canonical source, retrieval time, platform, and program version cues.
2. Preserve each asset exactly as published, then normalize host, path, application, API, mobile, hardware, and source-code targets into separate rows.
3. Pair every wildcard or grouped asset with its exclusions and notes.
4. Record allowed techniques, prohibited effects, rate limits, safe-harbor terms, and contact path.
5. Put conflicting or ambiguous rules in a question queue. Do not resolve them in the researcher's favor.
6. Compare the final working set to a negative control: an explicitly excluded asset must remain excluded after normalization.

## Output artifacts

- `scope-snapshot.md` with source and timestamp
- `scope-assets.csv` with normalized and original text
- `scope-questions.md` with unresolved conflicts and an owner

Redact private program data before sharing derived artifacts.

## Stop conditions

Stop when the live brief is unavailable, ownership is uncertain, rules conflict, or the intended technique is not clearly allowed.

## Completion gate

Complete only when each working asset maps to a current source row, exclusions remain attached, negative controls hold, and every ambiguity is resolved or explicitly deferred.