This is usually addressed in your program policy. For example, look at https://hackerone.com/twitter :

> Accessing private information of other users, performing actions that may negatively affect Twitter users (e.g., spam, denial of service), or sending reports from automated tools without verifying them will immediately disqualify the report