Bug bounty without rules of engagement is a confession waiting for a hostile reading.
“I found a hole” after poking production can be good faith — or it can be narrated as unauthorised testing. Scope, invitation, and what was touched matter. A polite email does not rewrite whether the access was authorised when the company later gets angry.
Helpful researcher.
Or uninvited probe — depending on the paper trail.
Educational note. This Insight is for awareness relating to cyber law and digital procedure. It is not legal advice and does not create an advocate–client relationship. Series: Digital disputes, as Indian courts actually see them.