[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-03 (世界標準時間)。"],[[["\u003cp\u003eApigee allows customers to conduct their own security testing on their Apigee and Apigee hybrid endpoints, requiring notification via a support ticket at least one business day in advance.\u003c/p\u003e\n"],["\u003cp\u003eCustomers need to include testing date, tester details, contact information, source IP addresses, and target IP/endpoint names when notifying Apigee about planned testing.\u003c/p\u003e\n"],["\u003cp\u003eGoogle performs weekly internal scans of Apigee for security vulnerabilities, but these results are not shared with customers, and customers must still perform their own security testing for compliance.\u003c/p\u003e\n"],["\u003cp\u003eApigee hybrid customers have unrestricted testing rights within their own networks, but Apigee only performs malware scanning of code released to them and does not provide testing reports.\u003c/p\u003e\n"],["\u003cp\u003eCustomers using Apigee-sponsored developer portals hosted by Pantheon or Acquia are permitted to conduct penetration testing, but must notify Apigee via a support ticket with the relevant testing details.\u003c/p\u003e\n"]]],[],null,["# Customer security testing requests\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nCustomer-requested testing of Apigee\n------------------------------------\n\nApigee allows and even encourages our customers to scan or test their own endpoints in\nApigee. We ask for notification of the scan only so that we are aware of the scanning in the\nevent the scanning causes an issue for your services. To notify Apigee of your planned testing,\nopen a support ticket at least one business day prior to the start of testing and provide the\nfollowing details:\n\n- Date of tests (start date and projected end date including time zone)\n- Name of person/company performing the testing\n- Contact info for person performing the testing\n- Source IP addresses of the testing\n- Target/Destination IPs and names of the systems being tested (API endpoint names)\n\nTesting is specifically not prohibited in customer agreements. Approval emails will not be\nsent, nor will authorization letters be signed, because there is no prohibition against the\ncustomer testing their own end points and configurations in Apigee.\n\nIf customers find vulnerabilities during their testing that they believe are because of the\nApigee platform itself, we ask them to submit this information to Apigee using a standard\nsupport ticket. By opening a support ticket, the issue can be tracked, escalated, and resolved\nas appropriate.\n\nOnce customers submit a vulnerability report through the standard Apigee support process, the\nSupport team will review the ticket and escalate to security and engineering teams as\nappropriate. Customers should expect a response in the ticket, although follow-up could come\ndirectly from Google security or engineering if more information is needed about the reported\nvulnerability.\n\nGoogle scanning of Apigee\n-------------------------\n\nApigee scans Apigee weekly. However, these scans are for internal\npurposes and not shared with customers. The Google scans look at publicly exposed endpoints and\nthe internal infrastructure. These scans are looking for missing patches, vulnerabilities,\nmisconfigured hosts, poor TLS configurations, and so on. They are part of the Google commitment\nto \"secure the platform.\"\n\nIf something was identified that directly related to a customer and was obviously incorrectly\nconfigured, we would notify the customer. But, since customers use both clear text and TLS\nconfigurations, and since some customers use Apigee for public data while others use Apigee for PCI\nor healthcare or other PII types of data, we are not in a position to determine what is always\nappropriate for all of our customers.\n\nThese Google scans may not be used by customers as fulfilling their own due diligence in\ntesting their endpoints and verifying secure configurations such as are required by PCI and other\nindustry or regulatory standards.\n\nCustomers are encouraged to perform their own testing of endpoints in Apigee for security or\ncompliance needs. See the [Customer-requested testing of Apigee](#request)\nsection of this document for instructions.\n\nCustomer testing of Apigee hybrid\n---------------------------------\n\nBecause Apigee hybrid customers have Apigee software within their own\nnetworks, customers are permitted to test the software. There are no limitations on testing of\nsystems or services that are managed by the customer directly.\n\nAs a result, however, Apigee does not provide testing reports to Apigee hybrid\ncustomers. Apigee *does* perform malware scanning of Apigee code before it is released to\ncustomers.\n\nFor Hybrid customers, the API processing services are within the customer's network, while the\nmanagement interface is in Apigee Cloud. Please review the [Customer-requested\ntesting of Apigee Cloud](#request) section of this document for details on management interface testing\nrestrictions.\n\nCustomer testing of\nApigee-sponsored developer portals hosted at Pantheon or Acquia\n-----------------------------------------------------------------------------------\n\nCustomers can perform penetration testing on their portals hosted by Pantheon or Acquia.\nApigee and Pantheon (or Acquia) need to be notified first, and customers can do this by opening a\nsupport ticket with Apigee.\n\nCustomers must provide the Support team with following details of the planned testing:\n\n- Date of tests (start date and projected end date including time zone)\n- Name of person/company performing the testing\n- Contact info for person performing the testing\n- Source IP addresses of the testing\n- Pantheon Site Names and URLs being tested"]]
