A tester discovers a vulnerable server outside the written scope. What is the best action?

1. Exploit it immediately because it belongs to the same company
2. Record the observation and request explicit scope clarification before further testing
3. Hide the finding so the report stays short
4. Assume a public IP address makes unrestricted testing legal