# BBRF Scope - All DoD Domains
bbrf inscope add '*.af.mil' '*.army.mil' '*.marines.mil' '*.navy.mil' '*.spaceforce.mil' '*.ussf.mil' '*.pentagon.mil' '*.osd.mil' '*.disa.mil' '*.dtra.mil' '*.dla.mil' '*.dcma.mil' '*.dtic.mil' '*.dau.mil' '*.health.mil' '*.ng.mil' '*.uscg.mil' '*.socom.mil' '*.dds.mil' '*.yellowribbon.mil'

✅ Permitted Use Cases

• ✅ Authorized Bug Bounty Programs - HackerOne, Bugcrowd, Intigriti, etc.
• ✅ Authorized Penetration Testing - With written permission
• ✅ Personal Lab Environments - Your own infrastructure
• ✅ Educational Purposes - Learning and research
• ✅ DoD VDP Program - Following program rules

❌ Prohibited Activities

• ❌ Unauthorized Testing - Testing without explicit permission
• ❌ Malicious Intent - Using techniques for harm or theft
• ❌ Out-of-Scope Testing - Testing targets outside program scope
• ❌ Social Engineering - Unless explicitly allowed in program
• ❌ DoS/DDoS Attacks - Resource exhaustion attacks

📋 Responsible Disclosure Guidelines

1. Read the Program Policy - Always review scope and rules
2. Test Safely - Don't cause harm to production systems
3. Document Everything - Keep detailed notes of your findings
4. Report Privately - Use official channels for disclosure
5. Give Time to Fix - Allow vendors reasonable time to patch
6. Be Professional - Maintain ethical standards

🔒 Report Security Issues

Found a security issue in this repository? Please report it responsibly: