Introducing snowpick: Testing ServiceNow for Public Data Exposure

TL;DR

ServiceNow portals can expose backend records through public widgets and API endpoints that query backend tables, even when the visible portal appears locked down.
snowpick is a Bishop Fox-built tool that checks those paths from an unauthenticated session and separates real row access from count-only leaks. It produces small, reproducible evidence packages so testers can prove impact and defenders can fix the exact misconfiguration without bulk data collection. Get the tool on GitHub.…