Whether you have bounty-style permission to test someone's site or not, a red line you never cross: post-exploit privilege exploitation and pivoting.

If you find a SQLI vulnerability, you assume you own not just the site but the whole deployment environment. You won. Don't go trying to prove you won. Very few companies, even the ones that post bug bounties, will put up with random people on the Internet owning up their backend servers.

Even on professional pentests, you ask permission to pivot. If it wasn't in the rules of engagement when the test began, chances are the answer is "no". (That's no surprise: there isn't much to be learned by the target from it. A gameover is a gameover.)