The below table shows the list of ServiceNow coding best practices that are not supported in all scan types.
The severity, area of impact and affected element for each best practice validation are also detailed.
The update set scan feature includes a sub-set of these checks.
Click the button below to open the table as a pop up.
| Description | Severity | Area of impact | Affected element | Included in Instance Scan | Included in Live Check Scan | Included in Update Set Scan | Included in Application Scan | Included in Update Set scan from XML |
|---|---|---|---|---|---|---|---|---|
| Inactivity Monitors | High | Performance | Inactivity Monitors |  |
 |
|
|
|
| Too many fields in a Form Section | Medium | Performance | Form Section | |
|
|
|
|
| High Security Settings plugin disabled | High | Security | Plugin | |
|
|
|
|
| Modules pointing to big tables without filter | Medium | Performance | Module | |
|
|
|
|
| The default system User Preference “Rows per Page” set above 100 | Medium | Performance | User Preference | |
|
|
|
|
| JDBC Data Sources with “Use last run datetime” option unchecked | Warning | Performance | Data Source | |
|
|
|
|
| Contextual Security Plugin disabled | High | Security | Security | |
|
|
|
|
| Debugging properties enabled in production environments | Low | Performance | System Property | |
|
|
|
|
| Forms with too many sections | Low | Performance | Forms | |
|
|
|
|
| Workflows with Notification Activities | Medium | Manageability | Workflow | |
|
|
|
|
| The “Log/trace level of TaskSLAController” System Property not set to “notice” | Low | Performance | System Property | |
|
|
|
|
| SOAP Request Strict Security should be enabled | High | Security | System Property | |
|
|
|
|
| Java Package Collection mode and Collection mode override properties should be disabled | High | Security | System Property | |
|
|
|
|
| Client Generated Scripts Sandbox should be enabled | High | Security | System Property | |
|
|
|
|
| Cookies – HTTP Only should be enabled | High | Security | System Property | |
|
|
|
|
| Escape HTML should be enabled | High | Security | System Property | |
|
|
|
|
| CSV Request Authorization should be enabled | High | Security | System Property | |
|
|
|
|
| SSLv2/SSLv3 should be disabled | High | Security | System Property | |
|
|
|
|
| AJAXGlideRecord ACL Checking should be enabled | High | Security | System Property | |
|
|
|
|
| SLA logging level should be set to “notice” | High | Performance | System Property | |
|
|
|
|
| Basic Auth SOAP Requests setting should be enabled | High | Security | System Property | |
|
|
|
|
| Old UI enabled or being used | High | Security | System Property | |
|
|
|
|
| Script Request Authorization should be enabled | High | Security | System Property | |
|
|
|
|
| Escape Jelly should be enabled | High | Security | System Property | |
|
|
|
|
| Enable AJAXEvaluate should be disabled | High | Security | System Property | |
|
|
|
|
| Anti-CSRF Token setting should be enabled | High | Security | System Property | |
|
|
|
|
| Escape XML should be enabled | High | Security | System Property | |
|
|
|
|
| HTML Sanitizer property should be enabled | High | Security | System Property | |
|
|
|
|
| The glide.xmlutil.max_entity_expansion system property value is not set to 3000. | Medium | Performance | System Property | |
|
|
|
|
| Roles assigned to an invalid user | low | Security | Role | |
|
|
|
|
| Empty roles assigned to groups | low | Security | User Group | |
|
|
|
|
| Empty role assigned to a user | low | Security | User | |
|
|
|
|
| The out of the box admin account should not be inactive or locked out | High | Manageability | User | |
|
|
|
|
| Flows should not use stages that are not defined in a Stage Set | Medium | Manageability | Flow | |
|
|
|
|
| The “glide.uxf.js_server.consolidate” System Property is set to “false”. | Medium | Performance | System Property | |
|
|
|
|
| The “glide.email.smtp.active” System Property is set to “false”. | High | Manageability | System Property | |
|
|
|
|
| The “glide.email.read.active” System Property is set to “false”. | High | Manageability | System Property | |
|
|
|
|
| The “glide.image_provider.security_enabled” System Property is set to “false”. | High | Security | System Property | |
|
|
|
|
| Integration accounts should not use the admin role | High | Security | User | |
|
|
|
|
| Child group does not contain all parent roles | High | Security | User Group | |
|
|
|
|
| Stage sets with duplicates entries | Medium | Manageability | Stage Set | |
|
|
|
|
| Workflows should not use stages that are not defined in a Stage Set | Medium | Manageability | Workflow | |
|
|
|
|
| Flows should not run using the admin role. | Medium | Security | Flow | |
|
|
|
|
| Groups should not have inactive members | High | Security | User Group | |
|
|
|
|
| HHRR system properties outside the “Human Resource Scoped” category | High | Manageability | System Property | |
|
|
|
|
| Flows should not be client callable | High | Security | Flow | |
|
|
|
|
| Dictionary entries present for a table that does not exist | High | Manageability | Dictionary | |
|
|
|
|
| Groups should not have an inactive manager | High | Security | User Group | |
|
|
|
|
| Update Sets should not include Knowledge Base articles without review. | High | Security | Update Sets | |
|
|
|
|
| Update Sets should not include images without review. | High | Security | Update Sets | |
|
|
|
|
| Avoid Creating cross-table Business Rule recursive loops | High | Performance | Business Rule | |
|
|
|
|
| Transform maps with boolean fields in their import set table | High | Manageability | Field Map | |
|
|
|
|
| The assessment_take2 UI page should be public | High | Manageability | UI Page | |
|
|
|
|
| Too many delete actions on an Update Set. | Medium | Manageability | Update Sets | |
|
|
|
|
| Portal pages should not be made public | High | Security | Service Portal Page | |
|
|
|
|
| The Change Request table should not be extended. | High | Manageability | Table | |
|
|
|
|
| Forms with duplicate fields | Medium | Manageability | Form Sections | |
|
|
|
|
| Auditing for Update Sets should be enabled | High | Manageability | System Property | |
|
|
|
|
| Scheduled Jobs run by deleted users | High | Manageability | Benchmark Scheduled Script Scheduled Data Collection Scheduled Data Import Set Scheduled Email of Custom Chart Scheduled Email of Query Builder Scheduled Email of Report Scheduled Entity Generation Scheduled Report Summary Generation Scheduled Script Execution |
|
|
|
|
|
| Script Includes with duplicate names | High | Manageability | Script Include | |
|
|
|
|
| Scheduled imports should not run at the same time | High | Performance | Scheduled Data Import Set | |
|
|
|
|
| Reports should not be made public | High | Security | Report | |
|
|
|
|
| Scheduled Jobs without a dedicated integration user | High | Security | Benchmark Scheduled Script Scheduled Data Collection Scheduled Data Import Set Scheduled Email of Custom Chart Scheduled Email of Query Builder Scheduled Email of Report Scheduled Entity Generation Scheduled Report Summary Generation Scheduled Script Execution |
|
|
|
|
|
| Roles without any user | Warning | Security | Role | |
|
|
|
|
| Avoid creating unnecessary tables in scoped applications which can impact your licensing cost. | Low | Manageability | Table | |
|
|
|
|
| The “glide.login.autocomplete” System Property is set to “true”. | Medium | Security | System Property | |
|
|
|
|
| The “glide.db.clone.allow_clone_target” System Property is set to “true”. | High | Manageability | System Property | |
|
|
|
|
| The “sn_hr_core.impersonateCheck” System Property is “false”. | High | Security | System Property | |
|
|
|
|
| The “glide.businessrule.callstack” System Property is set to “true”. | Medium | Performance | System Property | |
|
|
|
|
| Fields used to coalesce records in a Table Transform Map should be indexed. | Medium | Performance | Field Map | |
|
|
|
|
| Multiple Choice Catalog Variables with too many options. | Warning | Manageability | Variable | |
|
|
|
|
| Catalog with low usage of META tags. | Low | Manageability | Catalog | |
|
|
|
|
| Catalog with very low usage of META tags. | Medium | Manageability | Catalog | |
|
|
|
|
| Catalog with no usage of META tags. | High | Manageability | Catalog | |
|
|
|
|
| “Check UI Action Conditions check before Execution” should be enabled | High | Security | System Property | |
|
|
|
|
| Possible extra-sensitive PII usage in table column – Religion | High | Security | Dictionary | |
|
|
|
|
| Possible extra-sensitive PII usage in table column – Gender | High | Security | Dictionary | |
|
|
|
|
| Possible PII usage in table column – Nationality | Warning | Security | Dictionary | |
|
|
|
|
| Possible PII usage in table column – Address | Warning | Security | Dictionary | |
|
|
|
|
| Possible PII usage in table column – Passport | Warning | Security | Dictionary | |
|
|
|
|
| “Check UI Action Conditions check before Execution” should be enabled | High | Security | System Property | |
|
|
|
|
| Possible PII usage in table column – Email | Warning | Security | Dictionary | |
|
|
|
|
| “Allow Javascript tags in Embedded HTML” property should be disabled | High | Security | System Property | |
|
|
|
|
| Avoid workflows with too many timer activities | High | Performance | Workflow | |
|
|
|
|
| The System Property “Update on Iterate” is enabled. | Medium | Performance | System Property | |
|
|
|
|
| The System Property “Auto Complete Search” is set to “Contains”. | Low | Manageability | System Property | |
|
|
|
|
| The “Security Manager” System Property is set to “Allow Access”. | High | Security | System Property | |
|
|
|
|
| The System Property “Items per page” includes options over 100. | Medium | Performance | System Property | |
|
|
|
|
| The System Property “Go To Search” is set to “Contains”. | Low | Performance | System Property | |
|
|
|
|
| The SOAP Timeout value is over 5 minutes. | High | Performance | System Property | |
|
|
|
|
| Debug System Properties Enabled. | Low | Performance | System Property | |
|
|
|
|
| The System Property “Auto Complete Wait Time” exceeds 750 ms. | Medium | Performance | System Property | |
|
|
|
|
| Scheduled Jobs should specified a value for “Run as” field. | Medium | Security |
Benchmark Scheduled Scrip Scheduled Data Collection Scheduled Data Import Set Scheduled Email of Custom Chart Scheduled Email of Query Builder Scheduled Email of Report Scheduled Entity Generation Scheduled Report Summary Generation Scheduled Script Execution |
|
|
|
|
|
| Scheduled Jobs should not be run by inactive/locked out users. | High | Manageability |
Benchmark Scheduled Scrip Scheduled Data Collection Scheduled Data Import Set Scheduled Email of Custom Chart Scheduled Email of Query Builder Scheduled Email of Report Scheduled Entity Generation Scheduled Report Summary Generation Scheduled Script Execution |
|
|
|
|
|
| ACLs should not be entirely empty or contain the “Public” role | Warning |
Security Performance |
Access Control |
|
|
|
|
|
| Inline Scripts should not contain many lines of code. | Medium | Manageability | Inline Script | |
|
|
|
|
| GlideRecord should not be used in Inline Scripts. | Low | Performance | Inline Script | |
|
|
|
|
| GlideRecordSecure should not be used in Inline Scripts. | Low | Performance | Inline Script | |
|
|
|
|
| Avoid adding new dictionary entries without documenting their purpose and rationale | Low | Manageability | Dictionary | |
|
|
|
|
| Avoid Virtual Agent Topic creation | High | Performance | AI Virtual Agent | |
|
|
|
|
| Avoid creating long module titles | Medium | Manageability | Module | |
|
|
|
|
| List Layout with more than one List Element on the same position | High | Manageability | List | |
|
|
|
|
