[tptacek]

I would definitely not take this issue to HR. HR is not there to help you. Mostly, they're there to screw you out of a little bit more of your health insurance benefit every year. Escalating this above your manager is really just an opportunity to brand yourself "high drama".

You really ought to just have a conversation with your manager where you acknowledge that you have just learned that he doesn't want you testing the dev server for security vulnerabilities, and then you ask him what the most effective way is for the company to channel your interest in security.