Glossary
Bug Bounty Scope
A bug bounty scope defines, explicitly, what a security researcher is authorized to test as part of a program inviting outside researchers to look for vulnerabilities — which systems are in scope, which techniques are permitted, what counts as an acceptable way to demonstrate a finding. This boundary is what separates a legitimate, invited security test from what would otherwise be an actual unauthorized attack; the same technical action can be either, entirely depending on whether it falls inside the agreed scope.
A researcher is authorized to act only within that defined scope, and a finding or an exploitation attempt outside it isn't protected by the program's authorization — the program's authorization for testing doesn't extend to anywhere the scope didn't explicitly cover, which is exactly why the scope has to be written precisely rather than left broadly implied.