---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Baseline version 5.0

# New hardening settings for baseline version 5.0 {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
New hardening settings have been released with Security Center baseline version 5.0.

* [Enforce ACL on HR lifecycle events data](https://www.servicenow.com/docs/MA~ugnjmWjto0ZzxSt1GiA "Learn how to prevent unauthorized access to data in the Human Resources Lifecycle Events application by verifying that the glide.enforce_security_scope.sn_hr_le property is set to the secured value.")
* [Sanitize All Translated HTML Fields](https://www.servicenow.com/docs/GYUMHBrbJoe22MxCrkHdPQ "Learn how to configure the glide.translated_html.sanitize_all_fields property to the secure value to ensure that all translated_html elements are sanitized with an HTML sanitizer.")
* [Configure service portal widgets allow list](https://www.servicenow.com/docs/~lluD1KFMmizBKhtVS4kCQ "Learn how to configure the glide.service_portal.widget.allow_list property securely so that the access control lists (ACLs) for the tables don't expose sensitive information.")
* [Enforce ACL on HR Core Data \[New in Security Center 2.0\]](E59anRFsyZPpyzEd~_txIw "Learn how to configure the glide.enforce_security_scope.sn_hr_core property so that the Human Resources Scoped App: Core (com.sn_hr_core) plugin does not expose sensitive data to access control lists (ACLs) from all other scopes.")
* [Enforce ACL on HR Virtual Agent Data \[New in Security Center 2.0\]](GY41nhknb2FM3Bl3bZqQ9w "Discover how to set the glide.enforce_security_scope.sn_hr_va property to a secure value, preventing data leakage from the Virtual Agent Conversations scoped application.")
* [Configure service portal widgets table allow list](https://www.servicenow.com/docs/SqU75QxiXHP7Mo8NkKH~_Q "Learn how the glide.service_portal.widget.table_allow_list property enhances security by listing tables accessible to unauthenticated users through Service Portal widgets, dependent on additional checks and specific glide property settings.")
* [Enforce Security Scope for Service Application Information \[New in Security Center 2.0\]](j3zfgM5oJ_zbl2TmBBranw "Use the glide.enforce_security_scope.sn_svc_appl property to ensure that the data in master scope tables is secured.")
* [Prevent empty ACL creation](https://www.servicenow.com/docs/JmA3LpyVi04d62lvfL0BWA "Set the glide.security.empty_acl.popup_window.enabled property to the secure value of true to block attempts to create, update, or save an invalid ACL. This setting will also provide a client-side model to configure a role or security attribute for the ACL.")
* [Prevent Unauthenticated Access to Virtual Agent Embedded Web Client](https://www.servicenow.com/docs/N~oLST~ZLICeNigKazUttw "Learn how to configure the sn_va_web_client_app_embed table to block unauthenticated users from accessing embedded web clients.")
* [Set automatic token cleanup for token credentials](https://www.servicenow.com/docs/j11HDo29UDtmDqcLGlANCg "Use the com.snc.platform.security.token.auth.cleanup property to ensure that expired API keys and HMAC secrets are deleted, thereby limiting the potential for token reuse.")
* [Restrict Global App Development by Role](https://www.servicenow.com/docs/q7DfnILpTUmVPlb~zCnybA "Use the sn_g_app_creator.allow_global property to control which users can create applications in the global scope using the Guided Application Creator.")
* [Enable ACLs for Encoded Query in Simple List Widget](https://www.servicenow.com/docs/jXR8OY5cWu_XtoCXnn3fIQ "Learn how to set the glide.service_portal.enable_acls_for_encoded_query_in_list property to the secure value to prevent users from bypassing access control list (ACL) evaluations on a query condition in the Simple List Widget.")
* [Invalidate Session After OAuth Token Expiration \[New in Security Center 2.0\]](otCqfj0JhpONyjqgR9lWuQ "Use a system property to the secure value to prevent users from continuing to use a session via cookies after the OAuth token used to create the session expires.")
* 
* [Restrict Impersonation to Admin](https://www.servicenow.com/docs/bHu7La6XcWK6ZjlrCP9nIg "The glide.sys.permissive.impersonate property can be used to prevent non-admin roles from impersonating other users.")
{#new_hardening_settings_for_baseline_version_5__ul_u2d_qk2_mcc}