How do I add rules of engagement, such as no destructive payloads in production?

Steps

1. Open the profile. Use the pencil icon on its row in Scan Profiles, or start a new profile.
2. Go to Reporting. Choose Reporting in the left-hand switcher.
3. Find the box. Scroll to Rules of engagement. The hint reads "Free-form engagement rules (e.g. avoid destructive payloads in prod)."
4. Write your rules. Use short, clear sentences. Say what the scan may do, what it must not do, and any hours or areas to leave alone.
5. Save. Click Save in the footer.

Good to know

Rules of engagement are the ground rules for a test. Writing them down gives the scan clear limits, and it gives your team a record of what you decided. Typical lines cover payloads that could delete data, accounts the scan must not touch, and pages to leave alone.

Cyberlop redacts personal data you type here, such as emails, phone numbers, ID numbers and payment cards, before analysis. Web addresses and IP addresses stay, so the scan can use them.

Treat this box as guidance, not a lock. For firm limits, combine it with other controls. Add Avoid rules for paths and hosts, and untick Run exploitation phase if you want static analysis only. Use a Dev or Staging target where you can.

Test only systems you have permission to test. If you need help writing safe rules for production, ask at /contact.

Related questions

• How do I turn off the exploitation phase?
• How do I exclude a URL path or subdomain from a scan?
• How do I stop a scan from testing a certain HTTP method?
• How do I steer how the final report is written?
• How do I mark a target as Dev, Staging or Prod?

Full tutorial

Reporting rules in Cyberlop: severity, confidence, guidance and PII redaction

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre