--- sourceDocument: Brazil Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Architecture, design, and threat modeling # Architecture, design, and threat modeling {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read This broad control addresses high level design considerations and key elements to implement a secure application. This covers the tenants of availability, confidentiality processing integrity, non-repudiation and privacy. Additionally, elements of a secure software development lifecycle are included. * **[Capture audit records for Code Signing-protected records](https://www.servicenow.com/docs/RyesXBeh6hRsJ_Hw5DRg7Q)** Use the sn_cse.com.snc.csf.vault_audit_enabled property to control whether the system logs changes to Code Signing-protected code. * **[Check impersonation on ACL evaluation in HR App \[New in Security Center 1.3 and updated in 1.5\]](lPdQIrkEp3OGoFR6HB69Vw)** Use the sn_hr_core.impersonateCheck property to prevent a user from impersonating another user and accessing their HR information. * **[Reduce the scope of the IP allow List for an instance](https://www.servicenow.com/docs/O2AnRJUG7RTliIkloEvR1Q)** Use the glide.ip.authenticate.strict property to specify IP ranges that can make inbound connections on an instance. * **[Disable legacy JQuery behavior](https://www.servicenow.com/docs/fhFC936qVgYzJ2RT7TdufA)** The glide.jquery.legacy is used to prevent older prepatched JQuery versions from being used which will introduce unpatched vulnerabilities in the library. * **[Disable GlideRecord scope fencing legacy behavior](https://www.servicenow.com/docs/LuDiSg77tE8SZZIJ~3aFGg)** The glide.record.legacy_cross_scope_access_policy_in_script property disables scope fencing allowing scoped apps to access global script interfaces. It was created as a patch to GlideRecord's cross scope access. * **[Disable legacy AngularJS behavior \[Removed in Security Center 2.2\]](FM4I9YFmrmj5Lmc6f_q6gw)** Use the glide.angular.legacy property to protect from potential security risks arising from attacks on vulnerabilities discovered in outdated AngularJS library versions. * **[Disable local login for users with Single Sign-On (SSO) enabled](https://www.servicenow.com/docs/G1HcEZmVOn~77lmeZAw84w)** Update user records to disable local login for users with Single Sign-On (SSO) enabled. * **[Disable unauthenticated published reports](https://www.servicenow.com/docs/UjsTk231LgB~j_8_~hzWCg)** Deactivate this property to prevent the user from publishing or accessing reports. This property disables the published reports feature in reporting. * **[Disable public access to favorites](https://www.servicenow.com/docs/BC6ea3EcdfWfW2MQU4GRtQ)** Use the glide.ui.magellan.favorites.allow_public to specify whether unauthenticated users are allowed to see Favorites in the navigator. * **[Enable CRL-based certificate revocation checking for outbound HTTP requests](https://www.servicenow.com/docs/VNJd4BaDsWC5TtzVNOT7Lw)** Use the com.glide.communications.httpclient.disable_crl_check property to control Certificate Revocation List (CRL) revocation checking for outbound HTTP requests over Transport Layer Security (TLS). * **[Enforce CRL certificate revocation checking for outbound HTTP requests](https://www.servicenow.com/docs/4jg2V_LCBW90na4_tSaCwA)** Use the com.glide.communications.httpclient.fail_on_non_pass_crl_status property to control whether the platform terminates outbound HTTP requests when Certificate Revocation List (CRL) checks can't determine revocation status. * **[Enforce domain access control on all tables](https://www.servicenow.com/docs/Ynu~JFwd3WG7mmkcP5x_Ow)** The glide.sys.domain.access_handler.included_tables property controls which tables have cross-domain write protection enforced. * **[Enforce field ACLs for inbound query requests](https://www.servicenow.com/docs/CVd5anxbrE5vKgd2TDyUSg)** Manage how incoming queries are validated on your instance. * **[Enforce read ACLs on report views](https://www.servicenow.com/docs/ZbmBqNv_xOrG1T_~ULBXDg)** Manage how Read ACLs are enforced on your instance. * **[Enable Anti-CSRF Token for Userperf](https://www.servicenow.com/docs/cQ4lN7dWJzJE_qk5BmvI1A)** Use a system property to ensure CSRF (Cross-Site Request Forgery) protection is enforced when setting user preferences. * **[Enforce Query ACLs for Knowledge Quick Links](https://www.servicenow.com/docs/s4Ix9ZCQM3XvzJz6db0iSA)** Enforce query ACLs for Knowledge Quick Links using a system property. * **[Enforce Query ACLs for SubLists, List Counts and Widget Data Tables](https://www.servicenow.com/docs/D2W5~KhKdS4KvIqJSTgqaA)** Enforce query ACLs on sublist, list count, and widget data table queries using system properties. * **[Enforce valid query string choice \[New in Security Center 7.0\]](_~4GCnCwhnxKdTEkaX735g)** Use a system property to ensure that any choice field value, when passed via a URL query string, is a valid active choice when a record is created. * **[Ensure An Instance is Allowed to Connect to Only Trusted IP Addresses](https://www.servicenow.com/docs/gB6HdrLjc6VootPBVPbk~A)** Use a system property to define a list of IP ranges that are appended to the outbound IP allow list. * **[Ensure only Trusted IP Addresses are Allowed to Connect to An Instance](https://www.servicenow.com/docs/55rbDlVA80uiJldZgAwLTA)** Use a system property to define a list of IP ranges that are appended to the outbound IP allow list. * **[For Self-Hosted Instance, Ensure only Trusted IP Addresses are Allowed to Connect to An Instance](https://www.servicenow.com/docs/qgKLOEtrsBvJ3ClxO8oOmg)** Use system properties to control which inbound IP addresses can connect to self-hosted instances. * **[Prevent disabling of data separation enforcement](https://www.servicenow.com/docs/YWEwJblufc~4Napn3Faf_A)** Prevent bypassing Mosaic domain-visibility filtering to maintain data separation boundaries across business units and customer domains. * **[Require authorization for data broker rest API](https://www.servicenow.com/docs/egurxEfZW0hP08VnSngZew)** Use the glide.basicauth.required.databrokerrestapiprocessor property to require basic authorization for all inbound Data Broker Rest API requests. * **[Restricted Binding functionality in Case Bearer authorization](https://www.servicenow.com/docs/RPz7Uo5VVXNdK9XPPi~lcQ)** Restricted Binding Functionality in Case Bearer Authorization * **[Deny by default with empty ACLs](https://www.servicenow.com/docs/f9IYeEaBjLh5uuURy04PxQ)** Use the glide.sm.default_mode property to control the default behavior of security manager when it finds that existing Access Control List (ACL) rules are a part of wildcard table ACL rules. * **[Set automatic token cleanup for token credentials](https://www.servicenow.com/docs/j11HDo29UDtmDqcLGlANCg)** Use the com.snc.platform.security.token.auth.cleanup property to ensure that expired API keys and HMAC secrets are deleted, thereby limiting the potential for token reuse.