Update out of scope list (#1097)

Author: cnkk

vulnerability-disclosure-program.md

@@ -85,6 +85,7 @@ By disclosing a vulnerability, you agree that you may not publicly disclose your
 * Issues related to networking protocols or industry standards
 * Error information disclosure that cannot be used to make a direct attack
 * Missing security-related HTTP headers which do not lead directly to a vulnerability
+* Rate-limit bypass using Tor, VPNs, proxies, or other IP rotation without concrete security impact
 
 ### Safe Harbor