---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Apply static analysis to all users
# Apply static analysis to all users {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 1 minute to read
Configure static analysis to examine scripts from both authenticated and unauthenticated users rather than limiting analysis to guest users only.
By default, static analysis examines all scripts regardless of user authentication status. Setting the com.glide.script.static_analysis.only_check_unauthenticated_users property to true
limits analysis to unauthenticated users only, creating a security gap for authenticated users. Setting the property to false confirms comprehensive security coverage across all user types.
To configure this property:
1. Navigate to /sys_properties_list.do on the \ instance.
2. Verify the com.glide.script.static_analysis.only_check_unauthenticated_users property is set to false.
{#sc-apply-static-analysis-to-all-users__ol_config_steps}
## More information {#sc-apply-static-analysis-to-all-users__section_more_info}
{#sc-apply-static-analysis-to-all-users__table_property_details__entry__2}
| Attribute | Description |
|-|-|
| Configuration name | com.glide.script.static_analysis.only_check_unauthenticated_users |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | false |
| Default value | false |
| Fallback value | false |
| Category | [Malicious code](https://www.servicenow.com/docs/K1DqQQ9~Zs_MfYpJc8oc5w "The Malicious Code category ensures that best efforts are made to confirm that your code is free of vulnerabilities and unwanted functionality.") |
| Security risk | * Security risk rating: Medium * CVSS score: 6.8 * Security risk details: When this property is set to true, static analysis applies only to unauthenticated users, creating significant security gaps: * Authenticated users can execute malicious scripts without detection. * Insider threats from legitimate users bypass static analysis. * Attacks that use stolen credentials or session hijacking avoid analysis. * Assumes authenticated users are trusted which may not be valid in all environments. * Service accounts and integration users may have elevated privileges but bypass analysis. {#sc-apply-static-analysis-to-all-users__ul_security_risks} |
| Functional impact | Setting this property to false brings authenticated-user scripts under static analysis. Existing authenticated-user scripts using patterns like Array.prototype access may trigger security violations. Test critical business rules, script includes, and scheduled jobs before rolling out this property. |
| Dependencies and prerequisites | The com.glide.script.static_analysis.disabled must be set to false for the com.glide.script.static_analysis.only_check_unauthenticated_users property to have any effect. |
[ ]
{#sc-apply-static-analysis-to-all-users__table_property_details}