Snowpick Open-Source Scanner Checks ServiceNow Exposure

A Free Tool That Lets Defenders Run the Attacker's Check First

On July 22, 2026, Bishop Fox released Snowpick, an open-source Go tool that tests a ServiceNow instance for unauthenticated data exposure. The premise is the good kind of simple: the techniques it uses have been publicly documented since 2023, so the only people who lacked a convenient way to run the check were the defenders who most needed the answer. Snowpick closes that gap.

• Snowpick published by Bishop Fox on July 22, 2026, available on GitHub at github.com/BishopFox/snowpick
• Written in Go; probes default Service Portal widgets plus 26 built-in table and field pairs
• In Bishop Fox's study of 166 instances, 31% returned records or confirmed record counts to a session with no credentials
• Each finding logs a record count, sample rows, and a reproducible curl command so teams can verify independently

How Does Snowpick Actually Test an Instance?

The method mirrors what an unauthenticated visitor can already do. Snowpick requests the public login page, extracts the session token ServiceNow issues to anonymous visitors, and reuses that token for subsequent API calls. It then probes default widgets and a built-in list of table-and-field combinations, and can discover custom widgets as it goes.

One design detail deserves credit: the tool distinguishes between actual row exposure and count oracles. That distinction matters a great deal to whoever has to triage the output. A widget returning a record count reveals something — you can learn how many entries exist in a sensitive table — but it is a different severity from one handing over the rows themselves. Tools that collapse both into a single alert generate noise; this one gives you the information needed to prioritise.

The curl reproduction command attached to each finding is the other thoughtful touch. It means a security team can hand a result to a platform owner who can confirm it in ten seconds without installing anything.

What Did the Study Find, and How Should You Read It?

Across 166 tested instances, 31% returned records or confirmed record counts without credentials, tracing to roughly three-quarters of the organisations in the dataset. The most common source was the attachment widget, which in exposed instances returned material like onboarding guides and access procedures.

Worth reading carefully: no credential theft occurred in this sample. The exposed material was internal documentation rather than secrets. That is a meaningful distinction — internal process documents are useful to an attacker doing reconnaissance, but this is a configuration hygiene finding, not a breach report.

It is also not a product vulnerability. These are customer-configured access controls on public-facing Service Portal widgets. ServiceNow gives administrators granular control over table, field and row-level access; the exposures come from portals published with broader read access than intended, usually because a widget's default scope was never narrowed after deployment.

The Shared-Responsibility Framing

Bishop Fox's Emilio Gallegos, who developed the tool, framed it as exactly that: "This is shared responsibility." Platform vendors should ship conservative defaults; customers should test their own public instances the way an attacker would. Both halves are true, and neither substitutes for the other.

That framing is why releasing the tool publicly is the constructive move rather than a risky one. The techniques were already documented — Aaron Costello published the widget-simple-list exposure method, including session token bootstrapping and table enumeration, back in October 2023. Anyone motivated has had the recipe for nearly three years. What has been missing is a fast, repeatable way for the defending side to check.

What Should Teams Do With It?

The remediation path is concrete and mostly a config review:

1. Inventory public Service Portal widgets — specifically any returning ticket, attachment, knowledge base or catalog data.
2. Review table, field and row-level ACLs for the tables those widgets touch, and narrow anything broader than the portal actually needs.
3. Re-run the scan after changes to confirm the exposure is closed, using the included curl reproduction to verify.
4. Add it to a recurring check, since new widgets and portal pages get published continuously.

That last point is the one teams miss. A clean scan today says nothing about the portal page someone publishes next quarter.

Part of a Good Run for Open Defensive Tooling

Snowpick joins a genuinely strong stretch for free, auditable security tools — Microsoft open-sourced its Düsseldorf OAST platform so teams can self-host out-of-band testing, and vendors have been shipping agentic AI defence capabilities into general availability. The common thread across our AI security coverage is that capabilities once reserved for well-funded red teams keep arriving as tools any organisation can run.

What to Watch Next

Watch for coverage expansion beyond the initial 26 table-field pairs, community contributions adding checks for other SaaS platforms with similar public-portal patterns, and whether follow-up studies show the exposure rate dropping. A 31% baseline is a number worth measuring again in six months.

Sources: Help Net Security — July 22, 2026; Bishop Fox — Introducing snowpick — July 2026.