I would never do what this guy did, but when asked to pen test or otherwise seek to find vulnerabilities that I can exploit I get explicit authorization in advance signed by high muckymuks