---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Architecture, design, and threat modeling

# Architecture, design, and threat modeling {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
This broad control addresses high level design considerations and key elements to
implement a secure application. This covers the tenants of availability, confidentiality
processing integrity, non-repudiation and privacy. Additionally, elements of a secure software
development lifecycle are included.
* **[Check impersonation on ACL evaluation in HR App \[New in Security Center 1.3 and updated in 1.5\]](z1XIK9OFo2_fYW9Vm1QFww)**   
  Use the sn_hr_core.impersonateCheck property to prevent a user from impersonating another user and accessing their HR information.
* **[Reduce the Scope of the IP Allow List for an Instance](https://www.servicenow.com/docs/yet2lq6DSLTAPblgeAs55A)**   
  Use the glide.ip.authenticate.strict property to specify IP ranges that can make inbound connections on an instance.
* **[Disable legacy JQuery behavior](https://www.servicenow.com/docs/aEd6Ct333ZDCoYe3BmZRRQ)**   
  The glide.jquery.legacy is used to prevent older prepatched JQuery versions from being used which will introduce unpatched vulnerabilities in the library.
* **[Disable GlideRecord Scope Fencing Legacy Behavior](https://www.servicenow.com/docs/su8Os4nh6KvAYUk1AVwLrA)**   
  The glide.record.legacy_cross_scope_access_policy_in_script property disables scope fencing allowing scoped apps to access global script interfaces. It was created as a patch to GlideRecord's cross scope access.
* **[Disable legacy AngularJS behavior \[Removed in Security Center 2.2\]](B6HD6ldT5p57VBgihXOLXA)**   
  Use the glide.angular.legacy property to protect from potential security risks arising from attacks on vulnerabilities discovered in outdated AngularJS library versions.
* **[Disable local login for users with Single Sign-On (SSO) enabled](https://www.servicenow.com/docs/U7eFgFZnw8muL82x8JfAPQ)**   
  Update user records to disable local login for users with Single Sign-On (SSO) enabled.
* **[Disable unauthenticated published reports](https://www.servicenow.com/docs/c5MqK88F9HYgAbmceX4LYQ)**   
  Deactivate this property to prevent the user from publishing or accessing reports. This property disables the published reports feature in reporting.
* **[Disable public access to favorites](https://www.servicenow.com/docs/kSZy6ulrQpr~a9sX4rPtcA)**   
  Use the glide.ui.magellan.favorites.allow_public to specify whether unauthenticated users are allowed to see Favorites in the navigator.
* **[Enforce field ACLs for inbound query requests](https://www.servicenow.com/docs/GtZWWWO2MxXzt4J_HT23xw)**   
  Manage how incoming queries are validated on your instance.
* **[Enforce read ACLs on report views](https://www.servicenow.com/docs/QK31c1WeWOLhasEHztcXeQ)**   
  Manage how Read ACLs are enforced on your instance.
* **[Enable Anti-CSRF Token for Userperf](https://www.servicenow.com/docs/s4U2BMLB_H5OjP8xpDQYkg)**   
  Use a system property to ensure CSRF (Cross-Site Request Forgery) protection is enforced when setting user preferences.
* **[Enforce Query ACLs for Knowledge Quick Links](https://www.servicenow.com/docs/bMaBS6zBx4ZJwpEjRjDzZg)**   
  Enforce query ACLs for Knowledge Quick Links using a system property.
* **[Enforce Query ACLs for SubLists, List Counts and Widget Data Tables](https://www.servicenow.com/docs/15PtGnl0JA4Iuprwlqh~sA)**   
  Enforce query ACLs on sublist, list count, and widget data table queries using system properties.
* **[Enforce valid query string choice \[New in Security Center 7.0\]](D3CWsMCCM6fqEV4~OcH11g)**   
  Use a system property to ensure that any choice field value, when passed via a URL query string, is a valid active choice when a record is created.
* **[Ensure An Instance is Allowed to Connect to Only Trusted IP Addresses](https://www.servicenow.com/docs/PyonsT4SN4Po27PpK~BYHA)**   
  Use a system property to define a list of IP ranges that are appended to the outbound IP allow list.
* **[Ensure only Trusted IP Addresses are Allowed to Connect to An Instance](https://www.servicenow.com/docs/SCUZJjc3PR_4jpmtItO0mw)**   
  Use a system property to define a list of IP ranges that are appended to the outbound IP allow list.
* **[For Self-Hosted Instance, Ensure only Trusted IP Addresses are Allowed to Connect to An Instance](https://www.servicenow.com/docs/qGfveTJXwfF_Th_qlc9B~w)**   
  Use system properties to control which inbound IP addresses can connect to self-hosted instances.
* **[Require authorization for data broker rest API \[Updated in Security Center 1.3\]](MPABVEOW6Zret6hn3btQJQ)**   
  Use the glide.basicauth.required.databrokerrestapiprocessor property to require basic authorization for all inbound Data Broker Rest API requests.
* **[Restricted Binding functionality in case Bearer Authorization \[New in Security Center 7.0\]](PoeG1dKhaQjyDhoks9vqNw)**   
  Use a system property and restricted binding to ensure that an access token generated using that entity can't be used for UI calls.
* **[Deny by default with empty ACLs \[Updated in Security Center 1.3\]](mzBOacjBI9kRWB2sZCTQaA)**   
  Use the glide.sm.default_mode property to control the default behavior of security manager when it finds that existing Access Control List (ACL) rules are a part of wildcard table ACL rules.
* **[Set Automatic Token Cleanup for Token Credentials](https://www.servicenow.com/docs/SxoOytQYZiwb1jPXeoAbCQ)**   
  Use the com.snc.platform.security.token.auth.cleanup property to ensure that expired API keys and HMAC secrets are deleted, thereby limiting the potential for token reuse.