Agent WranglersRules of engagement Required
Test on a copy of the system
Run attacks against a staging copy with fake data. Touch production only for read-only checks the owner has approved.
How to do it
Build staging from the same code and settings as production. Fill it with made-up customers and test accounts. Give it its own keys, so a leaked key from the test is worthless elsewhere.
How to check
Staging and production return the same version number. Staging has no real customer records.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/test-a-copy.