clarify test exclusions

SECURITY.md

@@ -1,7 +1,5 @@
 # Security Policy
 
-## Supported Versions
-
 As announced in the [README](README.md) I only support the latest available release and `main` branch.
 
 | Version              | Supported          |
@@ -21,7 +19,27 @@ Depending on the size of the required fixes, this might take a couple of hours o
 
 You can expect that your message will be answered ASAP. 
 
-You will be mentioned in the release notes if your issue is valid. 
+Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
+Only interact with accounts you own or with explicit permission of the account holder.
+
+## Exclusions
+
+While researching, please refrain from:
+
+- Denial of service
+- Spamming
+- Social engineering (including phishing)
+ 
+YOU MAY NOT TEST AGAINST SERVERS (e.g. Kimai-Cloud, Demo) YOU DO NOT HAVE EXPLICIT PERMISSION TO TEST.
+
+There are official laws in the EU, that force the owner of a service to report any attack to the authorities.
+
+## Reward
+
+You will be mentioned in the release notes if your issue is valid.
+
 I am grateful for any (discrete) disclosure of vulnerabilities!
 
-Please note: if you are asking for money, I will not reply. I receive these scam messages every day...
+## Bug bounty
+
+Please note: if you are asking for money, I will not reply. I receive too many of these scam messages every day.