I want to learn bug bounty work and help fix accessibility and security problems. The first part of that work is not a scanner or an exploit. It is permission.
Read the program before touching the target
I start by writing down the assets that are in scope, the techniques that are allowed, the exclusions, rate limits, disclosure rules, and stop conditions. If something is unclear, I do not turn uncertainty into permission.
A finding is not responsible if getting it required ignoring the rules.
Keep the claim as small as the evidence
I separate what I observed from what I think it might mean. I keep reproduction steps focused, avoid collecting data I do not need, and stop when a test could affect other people or systems.
I am still learning. I would rather say that plainly than write like I already know everything. Careful work, useful notes, and respect for scope are the standard I want to build.