Always set crawl scope to prevent testing unauthorized targets - Respect `robots.txt` during authorized tests (but also review it for intelligence) - Be aware that crawlers can trigger destructive actions (DELETE endpoints, logout links) - Use authenticated crawling to discover protected content - N