8.54Security testing you should mention

Given your QA background, this is a great bridge.

For Mule → Salesforce I'd test:

valid credentials
→ succeeds

invalid credentials
→ rejected

expired/rotated credential behavior

restricted integration identity
→ allowed fields succeed

forbidden field/object
→ fails predictably

QA Mule
→ cannot reach/use PROD credentials

logs
→ no secrets

error responses
→ don't expose downstream tokens/internal details

TLS/certificate failures
→ handled appropriately

And also:

Does a debug-level incident dump an Authorization header?

Excellent thing to check.