The package excludes code changes, security or penetration testing, load testing, mobile devices, cross-browser coverage, 24/7 monitoring, production purchases, and extra flows or applications. Any expansion needs a separate written scope. Reports can identify failures but do not guarantee that every defect will be found.