Scan Security — example output

███╗ ██╗ ██████╗ ██╗ ██╗ █████╗ ██╗ ██╗ ██╗██╗████████╗ ████╗ ██║██╔═══██╗██║ ██║ ██╔══██╗██║ ██║ ██╔╝██║╚══██╔══╝ ██╔██╗██║██║ ██║██║ █╗ ██║ ███████║██║ █████╔╝ ██║ ██║ ██║╚████║██║ ██║██║███╗██║ ██╔══██║██║ ██╔═██╗ ██║ ██║ ██║ ╚███║╚██████╔╝╚███╔███╔╝ ██║ ██║██║ ██║ ██╗██║ ██║ ╚═╝ ╚══╝ ╚═════╝ ╚══╝╚══╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ✦ NowAIKit — The #1 AI App for ServiceNow - Running scan-security in direct mode (ollama)... # SECURITY AUDIT REPORT ====================== Scope: Partial instance (limited data provided) Focus: Scriptable artifacts (Business Rules, Client Scripts) Date: 2024-01-15 Data Source: Provided JSON payloads (incomplete dataset) --- ## ⚠️ AUDIT LIMITATIONS Critical Note: This audit is based on incomplete data. A production security audit requires access to ALL instance objects. The following data is truncated: | Missing Data | Impact | |--------------|--------| | ACL records | Cannot assess access controls | | Role definitions | Cannot assess privilege escalation | | Server scripts (includes, fixes, jobs) | Cannot assess code injection | | REST APIs | Cannot assess API security | | Email templates | Cannot assess notification exposure | | Portal widgets | Cannot assess XSS/CORS | | Transform maps | Cannot assess ETL security | | OAuth apps | Cannot assess auth token exposure | Recommendation: Run full audit in production with complete instance access. --- ## EXECUTIVE SUMMARY | Metric | Count | |--------|-------| | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Overall risk rating | LOW (based on available data) | Note: No security-critical patterns detected in the provided dataset. However, 50+ artifacts scanned is insufficient for a production-grade audit. --- ## DETAILED FINDINGS ### 📋 BUSINESS RULES (50 records scanned) | Finding ID | Severity | Category | Artifact | Evidence | Risk | Recommendation | |------------|----------|----------|----------|----------|------|----------------| | BR-001 | Medium | Server Script | `0000c3cf53780110164bddeeff7b1283` - Update child metric confidential status | Collection: `sn_grc_metric_definition` | No script provided - cannot assess code patterns. Missing script audit trail. | Request full script content for audit. Verify this rule doesn't expose confidential data. | | BR-002 | Medium | Server Script | `00044b00c3870110c2613d061840dd5b` - Delete model components for simple model | Collection: `sn_ent_model`, before hook | Delete operation without validation evidence. Could cascade delete sensitive data. | Add pre-delete validation in script: `gls.current.getDomain()` + record ownership checks. | | BR-003 | Low | Server Script | `00094cbc9f53220034c6b6a0942e7070` - Add Case IOC Entry | Collection: `sn_ti_m2m_task_attack_mode` | IOC data may contain sensitive threat intel. | Review field-level ACLs on related fields. Add audit logging. | | BR-004 | Medium | Server Script | `0013633653ec3e109a2b87b130e5e6ab` - Invalidate server cache | Collection: `sn_mcp_tool_definition` | Cache invalidation could expose cached sensitive data. | Implement cache versioning + invalidate with `gs.cacheInvalidate()` properly scoped. | | BR-005 | Medium | Server Script | `0016165573130110e289235f04f6a79f` - Validate Change Success Score Properties | Collection: `sys_properties` | Access to `sys_properties` table by business rule. | Verify this rule runs with scoped privileges. Add ACL: `sys_properties` + `read` only. | | BR-006 | Low | Server Script | `00206b6293701200ea933007f67ffbb3` - Update actuals for Portfolio | Collection: `cost_plan_breakdown` | Financial data modification. | Add field-level ACLs on sensitive fields (account numbers, amounts). | | BR-007 | Medium | Server Script | `0021984a533030101dcdddeeff7b12e4` - Validate duplicate search source | Collection: `ais_search_profile_ais_search_source_m2m` | Search profile data may contain query patterns. | Add logging: `gs.log()` → `gs.info()` only, not sensitive parameters. | | BR-008 | Low | Server Script | `00278b68430171103564fbe2acb8f2d3` - Reset Remediation Fields | Collection: `sn_vul_app_vulnerability` | Vulnerability remediation data may contain exploit info. | Add `setWorkflow(false)` warning + review for compliance needs. | | BR-009 | Medium | Server Script | `002823900b443200a6acc93563673a74` - Calculate NPV on Discount Rate Update | Collection: `pm_project` | Financial calculation - potential for unauthorized modification. | Add ownership check: `gs.getUserID() == current.created_by`. | | BR-010 | Low | Server Script | `002bd53377601110f47ba8aecd5a993e` - BOMA type inactivation validation | Collection: `sn_wsd_core_boma_type` | BOMA workplace data may contain location/tenant info. | Verify no external sync after inactivation. | --- ### 📋 CLIENT SCRIPTS (40+ records scanned - truncated) | Finding ID | Severity | Category | Artifact | Evidence | Risk | Recommendation | |------------|----------|----------|----------|----------|------|----------------| | CS-001 | Low | Client Script | `0014099c3711200024d1973ebebe5dbe` - Maximum Duration Range Check | Table: `sysrule_quota` | Quota rules may contain rate limit info. | Add `console.log()` filter: `if (!gs.hasRole('admin')) return;`. | | CS-002 | Low | Client Script | `001481ab5313101041bbddeeff7b1255` - Create default value | Table: `sn_templated_snip_channel` | Template channels may expose service topology. | Review for hardcoded sys_ids or credentials. | | CS-003 | Low | Client Script | `00231a30878b0010f734a7da0acb0b5d` - Validate Visible To Customer | Table: `sn_customerservice_task` | Customer service tasks contain sensitive data. | Ensure server-side ACLs prevent unauthorized read/write. | | CS-004 | Medium | Client Script | `0023f442775361104cb984e35b5a99b3` - Modify field msg for ip_address | Table: `pd_command_validation` | IP address validation - potential for command injection patterns. | Use `GlideAjax` with proper escaping: `xmlToJSON()` with `gs.encodeXml()`. | | CS-005 | Low | Client Script | `002a0286db6820501878853e68961940` - Remove tables from child | Table: `sn_agent_policy` | Agent policy data may contain internal configs. | Add data export warning: `gs.info()` for audit trail. | | CS-006 | Low | Client Script | `002b152697afe9502ddb74121153af6a` - On submit validation | Table: `` (empty - global) | Global onSubmit script - potential for privilege escalation. | Review script - ensure no `gs.getUserID()` bypass logic. | | CS-007 | Low | Client Script | `003093bb532320102f4cddeeff7b12c6` - Show overlap field based on data labels | Table: `pa_widgets` | Widget data labels may expose internal widget config. | Validate all labels via `$sce.trustAsHtml()` if HTML rendering. | | CS-008 | Low | Client Script | `0030a8f7e71323008901268b03f6a9a0` - Hide run time if new | Table: `sn_cda_tracking_profile` | Tracking profile data may contain monitoring patterns. | Review for sensitive tracking parameters in scope. | | CS-009 | Low | Client Script | `0031d790c30311008de24a3c5bba8f1d` - Exchange Activity Validation | Table: `wf_activity` | Workflow activity data may contain process logic. | Add role check: `if (gs.hasRole('admin')) continue;`. | | CS-010 | Medium | Client Script | `0034977777140110044e6e7f6b5a996e` - Show Apt Related Lists | Table: `sn_gf_goal` | Goal/achievement data may contain strategic info. | Add field-level ACLs on related list fields. | --- ## SEVERITY DEFINITIONS | Level | Definition | Example | |-------|------------|---------| | CRITICAL | Exploitable now; data breach or privilege escalation possible | Script with hardcoded API key in `sys_script_include` | | HIGH | Exploitable with moderate effort; significant data exposure | ACL with no condition on `sys_user_has_role` | | MEDIUM | Weakness that could be chained with other issues | Client script with `console.log()` exposing sys_id | | LOW | Best-practice violation; minimal direct risk | Missing audit logging on sensitive table | --- ## REMEDIATION PRIORITIES ### 🔴 CRITICAL (Fix Immediately) None detected in current dataset ### 🟠 HIGH (Fix within 1 week) None detected in current dataset ### 🟡 MEDIUM (Fix within 1 month) - BR-004: Cache invalidation on sensitive tool definition ... (58 more lines — full output truncated for screenshot)