Stay within the access you are authorized to use
Work only with systems, accounts and data that you have permission to test. Do not obtain someone else's records, interrupt availability or publish an exploit against a live service as part of a report.
State the expected behavior, observed behavior and minimal steps needed to reproduce the issue. Preparing an enquiry is not testing authorization or an agreement to pay a bounty. Participation and reward conditions require their own terms.