This feels like the equivalent of pen-testing without a contract ... Which is basically breaking and entering. (Slightly different context of course.)