---
sourceDocument: Zurich Impact
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/impact

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Impact

ft:clusterId :

    - ipact

bundleId :

    - ipact


---

# Healthscan definitions updates: May 2025 store

# Healthscan definitions updates: May 2025 store {#ariaid-title1}

* Release version: Zurich
* 
* Updated August 11, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 8 minutes to read

Some HealthScan definitions are deprecated or updated between releases.

## New definitions {#healthscan-definitions-may-store__section_vm3_w3f_cfc}

The following definitions have been added for the May 2025 release to improve performance, reduce false positives, and meet the latest coding practices. Some of these definitions will have a positive or negative impact on
your customer instance scores.

Due to process and technical constraints, a comprehensive impact analysis for the overall score impact could not be fully conducted for customer instances. As a result, there may be potential impact score drops that have not
been identified or addressed.
{#healthscan-definitions-may-store__table_nwp_z3f_cfc__entry__5}

| Number | Short description | Rating | Category | Update description |
|-|-|-|-|-|
| HSD0022569 | Service Operations Workspace ITSM Applications is installed and active | Discuss | User Experience​ | New definition that checks if the plugin sn_sow_itsm_cont is installed and activated​ |
| HSD0024649 | Reports with very long execution times​ | Discuss | User Experience​ | New definition to identify long running reports per DT thresholds​ |
[Table 1. New definitions (May 2025 release)]

{#healthscan-definitions-may-store__table_nwp_z3f_cfc}

## Updated definitions {#healthscan-definitions-may-store__section_v3s_43d_fdc}

The following definitions have been updated for the May 2025 release to improve performance, reduce false positives, and meet the latest coding practices. Some of these definitions will have a positive or negative impact on
your customer instance scores.

Due to process and technical constraints, a comprehensive impact analysis for the overall score impact could not be fully conducted for customer instances. As a result, there may be potential impact score drops that have not
been identified or addressed.
{#healthscan-definitions-may-store__table_h2p_mmd_fdc__entry__5}

| Number | Short description | Rating | Category | Update description |
|-|-|-|-|-|
| HSD0001011 | Common slow loading forms in the last 30 Days | Discuss | Performance | * New client threshold is 1 second (1000ms) * New total response threshold is 5 seconds (5000ms) {#healthscan-definitions-may-store__ul_pwq_yz2_cfc} |
| HSD0001106 | Applications should use Source Control | Discuss | Manageability | * New version runs in sub-prod only. * Added better error handling. * Added manual statistic {#healthscan-definitions-may-store__ul_zmn_d1f_cfc} |
| HSD0001107 | JavaScript Mode is not set correctly on application​ | Discuss | Manageability | New version makes clear distinction that globally scoped apps should be on ES5and scoped apps should be on ES12​ |
| HSD0001116 | Client Scripts should not be defined against the Global table​ | Recommend | Performance | Changed documentation URL to: https://developer.servicenow.com/dev.do#!/guides/latest/now-platform/tpb-guide/client_scripting_technical_best_practices#avoid-global-client-scripts |
| HSD0001164 | Use state, not Incident State or Problem State​ | Recommend | Manageability | * Condition filtered only for global scope incident and problem tables * Overall code standardization {#healthscan-definitions-may-store__ul_pvm_51f_cfc} |
| HSD0001174 | Scripted Web Services writing data directly​ | Recommend | Security | * Removed matching requirement for semicolons * Improved Regex to a single pattern * Removed repeated use of Regex patterns * Migrated from String.match to Pattern.test * Add updateMultiple() to pattern * Added 1K limit to findings * Forced Statistic even on failures {#healthscan-definitions-may-store__ul_tqj_z1f_cfc}​ |
| HSD0001193 | Use the condition field in Business Rules​ | Discuss | Manageability | * Simplified scriptingAmended query to allow * Findings on insert, update, delete and query * Business RulesCorrected RegExp Pattern * Clarified verbiage * Added condition to ignore "Auto Business rules" generated by the system {#healthscan-definitions-may-store__ul_bpz_kbf_cfc} |
| HSD0001205 | Widgets not used in any dashboards​ | Discuss | Manageability | * New version ensures that each finding flags custom widget that it is truly unrelated to a dashboard * Added defensive scripting * Added statistic {#healthscan-definitions-may-store__ul_ssz_4bf_cfc} |
| HSD0001207 | Form layout whitespace: make sure layout split does not have large empty areas because only one side contains fields.​ | Recommend | User Experience​ | * Updated Findings to be against sys_ui_sections containing the elements * Updated script to confirm these * Sections were updated by customer * Updated Findings display to contain the view names for these forms {#healthscan-definitions-may-store__ul_hhx_sbf_cfc} |
| HSD0001275 | Scripts should not contain hard-coded IDs​ | Recommend | Manageability | Excluded any tables starting with itfm_​ |
| HSD0001281 | getMessage() called in Client Script without preloading message key​ | Recommend | Manageability | * Condensed a couple regex into single pattern * Removed some string manipulation and replaced with regex capturing * Now detecting messages in double quotes as well {#healthscan-definitions-may-store__ul_tc5_zbf_cfc} |
| HSD0001344 | Minimize the number of options in a choice field​ | Discuss | User Experience​ | * Updated the script to correctly check for the presence of sys_choice_set updates in sys_update_xml * Updated the messaging in the Findings to show the Language in question to the customer * Confirmed that the sys_language record is also active {#healthscan-definitions-may-store__ul_ixj_dcf_cfc} |
| HSD0001378 | Reports not run for 3 months​ | Discuss | Manageability​ | Updated the query to filter out reports that are no longer active​ |
| HSD0001385 | Check for automatic indicators with no scores collected​ | Recommend | Manageability​ | * Updated script to confirm that baseline / provided indicators have active m2m records to collection jobs which are also active * Adjusted some variable names and return values to be more intuitive * Updated short description and recommendation to be more clear {#healthscan-definitions-may-store__ul_f4k_lcf_cfc} |
| HSD0001398 | Script Includes with duplicate names​ | Act | Manageability​ | An additional Base version check is added to trigger a finding for only non OOB records.​ |
| HSD0001467 | Duplicate foundation/core data found​ | Act | Manageability​ | * Updated statistics and findings to show the duplicate count per foundation table * Findings url gives an encoded url for next experience instances showing a descending order and for the non next experience providing a non encoded url (with out specifying order) {#healthscan-definitions-may-store__ul_ojg_scf_cfc} |
| HSD0001507 | Scheduled jobs should run as dedicated integration user accounts rather than as default system​ | Act | Security | * Short description: Scheduled jobs should run as dedicated integration user accounts rather than as default system * Excluded sys_flow_trigger_auto_script {#healthscan-definitions-may-store__ul_pgq_vcf_cfc} |
| HSD0001533 | The default "system" user preference for "rows per page" should be set to 50 or less​ | Recommend | Performance | Recommendation: Set the default rows per page global default property to max 50. Consider also setting the max allowable values in glide.ui.per_page property to 10,25,50. To change specific user's preferences back from larger values to lower ones, consider using a scheduled job to reset them after 7-14 days back to lower values unless the user continues to require large sets of data.​ |
| HSD0001561 | Client Scripts should check for isLoading and return​ | Discuss | Performance | * Modified the regular expression for robustness * Filters out base version (OOB) client scripts * Elaborated the description {#healthscan-definitions-may-store__ul_fwn_bdf_cfc} |
| HSD0001627 | Do not query audit log in your custom integrations and code.​ | Recommend | Performance | Added ua_scripted_defn to the excluded tables list​ |
| HSD0001695 | Modification of State Choice set (install_status) on alm_asset table.​ | Act | Upgradeability | * Altered code from using hardcoded list of states to checking for sys_update_xml from the customer marking the sys_choice_set as replace on upgrade == false * Updated the short description to "Modification of State Choice set (install_status) on alm_assettable." Where it was previously "Modification of State" {#healthscan-definitions-may-store__ul_zgy_r3f_cfc} |
| HSD0001755 | Modification of State Choice set (state) on resource_plan table.​ | Recommend | Upgradeability | Altered code from using hardcoded list of states to checking for sys_update_xml from the customer marking the sys_choice_set as replace on upgrade == false​ |
| HSD0002020 | Avoid long module titles​ | Discuss | User Experience​ | * Updated documentation url Updated code to ignore module titles containing "deprecated" * Added defensive scripting * Added statistic * Made code a little more efficient via more reliance on the database * Measurably improved performance {#healthscan-definitions-may-store__ul_wvr_ndf_cfc} |
| HSD0002089 | Breakdown element filter should have valid conditions​ | Act | Manageability | * Fixed issues with empty field name * General code cleanup * Now ignoring RLQ queries {#healthscan-definitions-may-store__ul_b1y_rdf_cfc} |
| HSD0002130 | Valid To dates set to reasonable values​ | Recommend | User Experience​ | * Updated definition to check for latest default * Valid to date = '2100-01-01' * Updated description to Valid to date = '2100-01-01' * Updated to relevant documentation url * Added defensive scripting {#healthscan-definitions-may-store__ul_snp_vdf_cfc}​ ​ |
| HSD0002151 | Use AngularJS services rather than window objects​ | Act | Performance | * Removed accidental inclusion of versioned HSD number in the short description * Added manual exception for the following line of code from cloned widgets:var dateFormat = window.NOW.dateFormat;​ {#healthscan-definitions-may-store__ul_al4_zdf_cfc} |
| HSD0002342 | Each Policy Statement should have a valid attestation template. | Discuss | Manageability | * Description updated * Documentation link adjusted Implemented 1k threshold on Findings * Resolved HSINQ0006628, HSINQ0005842, HSINQ0006736 {#healthscan-definitions-may-store__ul_kxl_g2f_cfc} |
| HSD0002464 | Inactive Knowledge Author​ | Act | User Experience​ | * Adjusted the script to correctly return the link to the records indicated in the Finding * Also adjusted script to only return a Finding where this is 1 or more KB Articles with a non-active Author reference {#healthscan-definitions-may-store__ul_mxv_k2f_cfc} |
| HSD0002602 | List Layout with more than one List Element on the same position​ | Act | Manageability | An additional Base version check is added to trigger a finding for only non OOB records.​ |
| HSD0002737 | UI Actions displayed as a button should be short and precise​ | Discuss | User Experience​ | * Updated documentation url * Elaborated the recommendation a little more {#healthscan-definitions-may-store__ul_b2v_r2f_cfc} |
| HSD0002808 | Scripts without description​ | Recommend​ | Manageability | * Definition now queries only * Client Scripts and Script Includes. * Definition flags customized record versions only (no base versions). * Redundant code was eliminated. * Defensive coding was added. * Tests showed performance improvement with 50% run time reduction * Code is easier to read {#healthscan-definitions-may-store__ul_xzz_52f_cfc} |
| HSD0003076 | Basic authentication credentials on SOAP Message definition​ | Recommend | Manageability | * If a SOAP Message Definition is utilizing a Basic Auth Profile, it is no longer reported * Added a standard try/catch to capture any potential errors * Added a summary Statistic {#healthscan-definitions-may-store__ul_cyb_1ff_cfc} |
| HSD0003094 | Enable Email Spam Scoring and Filtering​ | Recommend | Security | Updated documentation link to point to the same content in the newer syntax​ |
| HSD0003220 | Agent Workspace should be used for Incident Management​ | Recommend | User Experience​ | The definition is deprecated and is replaced by HSD0022569 (Service Operations Workspace ITSM). |
| HSD0003238 | Cannot Implement before Planned start date​ | Recommend | Manageability​ | * Fixed Query to look for future dates only * Updated documentation * URL Limiting to 1000 records {#healthscan-definitions-may-store__ul_cph_jff_cfc} |
| HSD0003995 | Change Management - CAB Manager role and CAB Management group​ | Recommend | Manageability​ | * Finding now pointing to the active CAB group without active members * Finding also created when there is no Active CAB groups * Finds more than one group with this scenario {#healthscan-definitions-may-store__ul_lpl_mff_cfc} |
| HSD0004447 | Enforce Strict User Image Upload​ | Recommend | Security | Updated the docs link to point to same content in the newer syntax​ |
| HSD0007988 | Technical Service Offerings with Parent Technical Service Reference​ | Recommend | User Experience​ | * Fixed the calculation formula that was resulting in NaN * General code cleanup {#healthscan-definitions-may-store__ul_ir3_tff_cfc} |
| HSD0008013 | Check for scheduled imports running at the same time.​ | Act | Performance | Removed a couple \|\| conditions that would never match to simplify the code.​ |
| HSD0008070 | Synchronous outbound calls should be carefully used in Business Rules and UI Actions.​ | Act | Performance | * Removed the 2nd sentence in the Recommendation field * Removed incorrect query condition incorrect query condition 'scriptNOTLIKEsetMIDServer' * Replaced the finding overrides and added line numbering to the output * Replaced ScriptUtils.removeCommentsfunction call use with new more performant and more accurate removeComments function {#healthscan-definitions-may-store__ul_eq2_zff_cfc} |
| HSD0009985 | Last family release upgrade occurred over 1 year ago​ | Act | Upgradeability | Checking glide.war property instead​ |
| HSD0012244 | HW Product Model with Useful Life​ | Discuss | Manageability | * Updated Recommendation * Updated Documentation URL * Limited results to 100 {#healthscan-definitions-may-store__ul_add_qgf_cfc} |
| HSD0013510 | Validate Remote Host​ | Recommend​ | Security | Updated description to state that if the setting is set to False vs "if not set to true"​ |
| HSD0013559 | Do Not Use Demo Certificates for Active SAML Configurations​ | Discuss | Security | * Corrected logic problem * Added try/catch * Added forced statistic {#healthscan-definitions-may-store__ul_jn2_wgf_cfc} |
| HSD0015207 | Limit Attachment Size in Training and Prediction Flows​ | Recommend | Security | Corrected system property and code​ |
| HSD0015246 | Enforce Credential Alias Usage​ | Discuss | Security | * Optimized remote script to take only * Validated MID servers into account. (at least 1) * Added try / catch * Added Statistic * Altered documentation link to be more specific to this issue {#healthscan-definitions-may-store__ul_fvd_chf_cfc} |
[Table 2. Updated definitions (May 2025 release)]

{#healthscan-definitions-may-store__table_h2p_mmd_fdc}