# RE for Security Research Allowed?

**URL:** <https://forum.inductiveautomation.com/t/re-for-security-research-allowed/88898>\
**Category:** Ignition\
**Created:** [April 16, 2024, 2:23pm UTC](https://forum.inductiveautomation.com/t/re-for-security-research-allowed/88898 "2024-04-16T14:23:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adnan\_Khan](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/adnan_khan/32/60931_2.png) [@Adnan\_Khan](https://forum.inductiveautomation.com/u/Adnan_Khan)\
**Post date:** [April 16, 2024, 2:23pm UTC](https://forum.inductiveautomation.com/t/re-for-security-research-allowed/88898/1 "2024-04-16T14:23:28Z")

</div>

Hi, I am wondering if security researchers are allowed to reverse engineer Ignition to look for vulnerabilities (and responsibly disclose if found). The ToS says no, but [https://security.inductiveautomation.com/](https://security.inductiveautomation.com/) mentions Pwn2Own and etc.

Thanks

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [April 16, 2024, 2:43pm UTC](https://forum.inductiveautomation.com/t/re-for-security-research-allowed/88898/2 "2024-04-16T14:43:53Z")

</div>

Regardless of what the ToS says, reverse engineering / decompiling the artifacts is happening regularly.

I don't even know if you're really bound by any terms if you haven't purchased a license.

Just go for it.

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [April 16, 2024, 2:50pm UTC](https://forum.inductiveautomation.com/t/re-for-security-research-allowed/88898/3 "2024-04-16T14:50:20Z")

</div>

The Digital Millennium Copyright Act has some explicit loopholes, managed by a commission, that override ordinary copyright enforceability. IIRC, security research was explicitly added to the list a few years ago. But IANAL, yada, yada.