Pardot Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://security.salesforce.com/responsible-disclosure-policy/
note: Salesforce runs a published Responsible Disclosure Policy plus a HackerOne program at the corporate level;
  Account Engagement (Pardot) is in scope as a Salesforce cloud rather than having its own programme. Notably
  there is NO RFC 9116 security.txt on any Salesforce or Pardot host — the policy is discoverable only by browsing
  security.salesforce.com, so an automated scanner finds nothing. The provider-published contact address comes
  from SECURITY.md in the vendor's own GitHub org.
policy_url: https://security.salesforce.com/responsible-disclosure-policy/
policy_http_status: 200
contact: security@salesforce.com
contact_source: https://github.com/pardot/api-schemas/blob/master/SECURITY.md
security_txt:
  served: false
  probed:
  - pi.pardot.com
  - pi.demo.pardot.com
  - developer.salesforce.com
  - www.salesforce.com
  - trust.salesforce.com
  - login.salesforce.com
  status: 404
bug_bounty:
  platform: HackerOne
  url: https://hackerone.com/salesforce
  http_status: 200
safe_harbor:
  granted: true
  statement: Salesforce pledges not to initiate legal action against researchers for penetrating or attempting
    to penetrate its systems as long as they adhere to the policy.
testing_guidance: Conduct all vulnerability testing against a Trial or Developer Edition instance and use test
  or demo accounts. For Account Engagement that means the pi.demo.pardot.com host, not pi.pardot.com — see
  sandbox/pardot-sandbox.yml.
coordinated_disclosure: Salesforce notifies potentially impacted customers before public disclosure and CVE
  release.
researcher_credit: https://security.salesforce.com/security-research-contributors/
advisories: https://security.salesforce.com/
evidence:
- source: https://security.salesforce.com/responsible-disclosure-policy/
  kind: disclosure policy
  http_status: 200
- source: https://hackerone.com/salesforce
  kind: bug bounty program
  http_status: 200
- source: https://github.com/pardot/api-schemas/blob/master/SECURITY.md
  kind: repo security contact
  http_status: 200
- source: https://security.salesforce.com/
  kind: security advisories hub
  http_status: 200