Our client would like to run security assessments on website we are building for them, hosted on Cloudflare. I think we might need written permission for this. The purpose is to check the front-end only without any brute force. Can you let me know if that’s the case and what we need to do to get permissions?
You don’t need written permission. Those tests won’t tax Cloudflare infrastructure in any way. The only requirement is that you test against an account you own, which I’m pretty sure is the case here.