[batch12]

I agree mostly. I don't think an unsanctioned assessment that goes this deep is pure white hat. It seems firmly gray to me.

> PCI and all of those other security protocols and programs don't draw the line at white-hat access vs black-hat access.

PCI mandates penetration tests. A white hat finding as a pentest isn't reportable as a breach. This one may be unless some gymnastics are used to call it an authorized test.