---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Require authentication by default for client-callable script includes

# Require authentication by default for client-callable script includes {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
By default, client-callable script includes that do not explicitly set visibility, are public. If needed, add the glide.script.ccsi.ispublic property to enable privacy control over all client-callable
script includes accessed by public pages.
The glide.script.ccsi.ispublic system property makes sure that client-callable script-includes, also known as Ajax script includes, are not automatically made available to non-authenticated users. If
glide.script.ccsi.ispublic is not set to the recommended value of false, then it allows script includes to be run as public scripts and grant unauthenticated users access to
instance data.

Ensure that the property glide.script.ccsi.ispublic is set to false.  
Warning:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-privacy-on-client-callable-script-includes__section_wc1_cqn_phc}

{#sc-privacy-on-client-callable-script-includes__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.script.ccsi.ispublic |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | false |
| Default value | false |
| Fallback value | false |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 7.5 * CVSS rating: High * Security risk details: Sensitive business logic or data is potentially exposed, increasing the risk of unauthorized access to instance resources. {#sc-privacy-on-client-callable-script-includes__ul_g1g_3sf_xwb} |
| Functional impact | If the client-callable script includes are designated as public (that is, this property is missing), then unauthenticated users can execute client scripts. Add the property restricts the execution of scripts by a non-logged-in user. |
| Dependencies and prerequisites | None |
[ ]

{#sc-privacy-on-client-callable-script-includes__table_ajc_b43_3kb}