Pen-test is safe only with written contract + scope.
Contract terms
- Identity of parties.
- Scope (which systems).
- Date + time range.
- Reporting procedure.
- Indemnity.
Bug bounty
- HackerOne, Bugcrowd platforms.
- Public + private programs.
- Reward + disclosure timing.
Frequently asked
I found a non-Scope system, disclosure?
Don't ask verbally first; then email request.
Unauthorized pen-test = penalty?
Yes; TCK 243 + 244.
Prize tax?
Self-employment income; subject to tax.
Relevant legislation
- TCK art.243-245 — Basic articles of cyber crimes.
- TCK art.158/1-f — Qualified fraud (information tool).
- CMK article 134 — Search for digital evidence.
- 5651 SK — Access blocking and content removal.
- Budapest Cybercrime Convention — Türkiye is a party; international cooperation.
Legal notice: This article is for general information purposes; A meeting with a lawyer is required for a concrete case.