You define what is in scope and the rules of engagement, under NDA. Nothing runs outside it.
The plan states what gets tested, in what order, and what proof each finding must produce.
Testing runs inside your boundary, with the pipeline visible to you step by step.
Every finding ships with a reproducible exploit, the remediation that closes it, and a re-test you can run again.