---
schema_version: "1"
id: 91ed4b39d1f8ae0fbe4a6e116c4e36e3c8a023ec5a27acda7eecca6605b38526
title: Run Vulnerability Assessment and Penetration Tests
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub-2/ch2-penetration-testing-policies.md
canonical_url: https://docs.mulesoft.com/cloudhub-2/ch2-penetration-testing-policies
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 8eca7abb42c07393253ac50e5da42992e4379270ba15c4701ae9296c998f9ce5
description: MuleSoft Documentation Site
latest: true
---
---
product: CloudHub 2.0
---

# Run Vulnerability Assessment and Penetration Tests

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

If your company security policies require that you perform vulnerability and penetration testing
against Anypoint Platform, you can commence testing without notifying Salesforce beforehand.

All assessments must be performed in accordance with the
[Security Assessment Agreement](https://help.salesforce.com/s/articleView?id=000392845&type=1).

## Run Penetration and Vulnerability Tests

Because penetration testing can interfere with other tenants, MuleSoft allows penetration testing on
your workers but not on other Anypoint Platform services.

> [!IMPORTANT] Salesforce does not address vulnerabilities found with custom development. You must
> validate and fix any findings with your custom development.

### Prerequisites

Before initiating penetration testing:

- Assign a security resource at your company to review and validate findings from the tests.

### Steps

1.  Run the penetration tests.

    The Security Assessment Agreement includes restrictions and requirements for testing.

2.  Have your security resource use the following documents to identify common false positives and
    security issues related to settings:

    - [Platform Security FAQ](https://help.salesforce.com/s/articleView?id=000383448&type=1)

    - [Salesforce Help](https://help.salesforce.com/s/)

3.  If your assessment generates vulnerability findings, complete validation for any automated
    finding. Send all outstanding validated security vulnerability findings to the Salesforce
    Security Team at [security.salesforce.com/contact](https://security.salesforce.com/contact).

    Include the following information in your email:

    - Confirmation number for your Security Assessment approved by Salesforce

    - Summary of all findings and the associated severity level of each finding

    - Detailed assessment report that notes each finding

    - Steps to reproduce the vulnerability

    - All applicable HTTP requests and responses

    - Explanation of why the example is considered a finding

### Reporting Security Vulnerabilities

To report security vulnerability findings, follow the
[Security Vulnerability Finding Submittal Guide](https://help.salesforce.com/s/articleView?id=000384043&type=1).
Security vulnerability reports that do not follow the required steps are rejected.

Salesforce does not address any security vulnerabilities in the following categories:

- Scan output from automated vulnerability scanning tools without a valid proof of concept

- Security bugs without valid proof of concept

- Vulnerabilities identified in old or deprecated versions of Mule runtime engine

- Vulnerabilities introduced via code customization made by your company

- Known security issues that don’t pose any risk

## See Also

- [CloudHub 2.0 Overview](https://docs.mulesoft.com/cloudhub-2/)

- [Deploying Apps to CloudHub 2.0](https://docs.mulesoft.com/cloudhub-2/ch2-deploy)

- [Managing Apps Deployed to CloudHub 2.0](https://docs.mulesoft.com/cloudhub-2/ch2-manage-apps)

- [Deployment Options](https://docs.mulesoft.com/runtime-manager/deployment-strategies)