Passive Recon (prospecting — no written authorization)

Scope

Prospect domains whose owner has NOT given written authorization: community/product targets, lead-generation scans, perimeter check-ups. Output is sales-conversation material and responsible-disclosure pre-work — not a client report. Default batch: N domains from scope.md, run in waves of parallel subagents.

If the owner DOES authorize (keep the written evidence on file) — stop, open an engagement, and switch to web-pentest for the active phase.

Hard rules