Do I need authorization from Zendesk to perform a penetration test?

Question

I would like to perform a penetration test. Do I need authorization from Zendesk?

Answer

No, you don't need authorization from Zendesk to perform a penetration test. You can perform this test anytime, but Zendesk recommends avoiding Thursdays. Zendesk usually runs deployments on Thursdays, which may cause scanners to report false positives or false negatives.

To do the test, you must abide by the terms of the responsible disclosure policy and follow the Bugcrowd guidelines:

No test likely to cause service outages for other tenants is tolerated, such as DoS, DDoS, or RDDoS

Social engineering Zendesk or sub-contractor activities aren't allowed

After you complete the test, submit your results to security@zendesk.com. The team identifies any issues.