Good discussion on vulnerability scans (allowed) and pentesting (not allowed) in GCC-High.