--- sourceDocument: Brazil Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Enable KittyScript sandbox security enforcement # Enable KittyScript sandbox security enforcement {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Enable KittyScript sandbox security enforcement The KittyScript sandbox security enforcement in ServiceNow Brazil release prevents untrusted scripts from running with unrestricted system privileges, protecting your platform from malicious code execution. This feature is part of the Guarded Scripts framework and uses configurable system properties to control enforcement levels and timing. Show full answer Show less ## Key Configuration Properties * **com.glide.script.sandbox.ks.watchdog.enabled** : Master switch for sandbox enforcement. Set to **true** to activate enforcement on all untrusted scripts; **false** disables sandbox protections entirely. * **com.glide.script.sandbox.ks.watchdog.auto.advance**: Controls automatic progression through enforcement phases, from detection-only to full restriction. * **com.glide.script.sandbox.ks.watchdog.phase.duration.days**: Defines how many days each enforcement phase lasts before advancing. * **com.glide.script.sandbox.ks.watchdog.phase**: Sets the current enforcement level (Phase 1 to 3), with Phase 3 enabling full restrictions on script execution. Recommended settings to ensure robust sandbox security: * com.glide.script.sandbox.ks.watchdog.enabled = **true** * com.glide.script.sandbox.ks.watchdog.auto.advance = **true** * com.glide.script.sandbox.ks.watchdog.phase.duration.days = **14** * com.glide.script.sandbox.ks.watchdog.phase = **3** ## Importance and Risks Proper configuration is essential to maintain platform security: * Disabling enforcement (**enabled = false**) removes sandbox protections, allowing untrusted scripts full system access, risking data theft or system compromise. * Freezing enforcement at Phase 1 (**auto.advance = false**) keeps scripts in a permissive detection-only mode, delaying necessary security restrictions. * Extending phase duration excessively delays enforcement tightening, increasing the window for potential exploits. * Running in permissive phases (1 or 2) allows untrusted scripts to bypass restrictions, enabling attackers to exploit vulnerabilities. ## Expected Outcomes * With recommended settings, all untrusted scripts are checked for security violations, and enforcement progressively restricts unauthorized data or API access. * This approach establishes a secure operating mode that mitigates risks from malicious or poorly written scripts. * Disabling enforcement should only be a temporary measure during emergencies, as it exposes the system to significant security threats. ## Additional Notes There are no dependencies or prerequisites for enabling KittyScript sandbox enforcement. Ensure the system properties are correctly set in the **sysproperties** table to maintain platform security. KittyScript sandbox enforcement prevents untrusted scripts from executing with unrestricted system privileges. The following properties control enforcement activation, level, and timing. Configuring them incorrectly can cause malicious code to bypass security protections and access restricted APIs. * **`com.glide.script.sandbox.ks.watchdog.enabled`** (default: `true`): Master control for the KittyScript sandbox security interpreter in ServiceNow Guarded Scripts framework. When set to `true`, all untrusted scope scripts are subject to sandbox enforcement. When set to `false`, disables KittyScript entirely. * **`com.glide.script.sandbox.ks.watchdog.auto.advance`**: Controls whether the watchdog automatically advances from Phase 1 (detection-only) to Phase 3 (full rejection). * **`com.glide.script.sandbox.ks.watchdog.phase.duration.days`**: Specifies how long each active phase persists before advancing to the next phase. * **`com.glide.script.sandbox.ks.watchdog.phase`**: Sets the enforcement level (Phase 1--3) for authenticated script execution. Phase 3 enforces full restrictions. Verify the following properties exist in the `sys_properties` table and set them to the specified values if they exist: * `com.glide.script.sandbox.ks.watchdog.enabled` = `true` * `com.glide.script.sandbox.ks.watchdog.auto.advance` = `true` * `com.glide.script.sandbox.ks.watchdog.phase.duration.days` = `14` * Create or update the `com.glide.script.sandbox.ks.watchdog.phase` property. Set the value to `3`. {#sc-kittyscript-sandbox-security__ul_lfs_kx3_bkc} ## More information {#sc-kittyscript-sandbox-security__section_pyv_1z3_bkc} {#sc-kittyscript-sandbox-security__table_u1q_2z3_bkc__entry__2} | Attribute | Description | |-|-| | Configuration name | com.glide.script.sandbox.ks.watchdog.enabled com.glide.script.sandbox.ks.watchdog.auto.advance com.glide.script.sandbox.ks.watchdog.phase.duration.days com.glide.script.sandbox.ks.watchdog.phase | | Configuration type | System Properties (/sys_properties_list.do) | | Data type | Boolean, Boolean, Integer, Integer | | Recommended value | true, true, 14, 3 | | Default value | true, true, 14, 0 | | Fallback value | true, true, 14, 0 | | Category | [Validation, sanitization, and encoding](https://www.servicenow.com/docs/Y54hkYpvZcFtgJ5PMM2JEw "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") | | Security risk | * Severity score: 8 * CVSS rating: High * Security risk details: Disabling the com.glide.script.sandbox.ks.watchdog.enabled property removes all sandbox protections for untrusted scripts, allowing malicious or poorly-written code to execute with full system privileges and access restricted APIs. This can lead to data theft or system compromise. Disabling the com.glide.script.sandbox.ks.watchdog.auto.advance property freezes enforcement at Phase 1 (detection-only), allowing scripts with unsupported features to continue executing indefinitely without sandbox restrictions, indefinitely deferring security hardening platform-wide. Setting the com.glide.script.sandbox.ks.watchdog.phase.duration.days property to a value too high delays enforcement phase transitions. This leaves the platform in permissive phases (1-2) longer than intended and extending the window where malicious scripts can bypass sandbox protections. Setting the com.glide.script.sandbox.ks.watchdog.phase property to permissive phases (1-2) allows untrusted scripts to execute without sandbox enforcement. This enables attackers to exploit vulnerable code paths, access unauthorized APIs, and potentially escalate privileges or exfiltrate data. {#sc-kittyscript-sandbox-security__ul_g1g_3sf_xwb} | | Functional impact | **When set with recommended values:** The system checks all scripts for security violations. Restrictions progressively enforce, blocking scripts from accessing unauthorized data or APIs. This is the secure, standard operating mode. **When turned off:** All script security checks are turned off. Scripts execute without restrictions, creating significant security risks. While disabling enforcement can temporarily resolve broken scripts during emergencies, it exposes the system to malicious or poorly written code. | | Dependencies and prerequisites | None | [ ] {#sc-kittyscript-sandbox-security__table_u1q_2z3_bkc}