Find sensitive data leaking from ServiceNow instances.
A ServiceNow exposure scanner that finds misconfigured widget ACLs, REST API access controls, and unauthenticated data leaks
snowpick is a ServiceNow exposure scanner that finds misconfigured widget ACLs, REST API access controls, and unauthenticated data leaks.
ServiceNow exposes data through two surfaces: its Service Portal (widgets) and its REST API. When access controls on either are misconfigured, anyone on the internet can query internal records like incident tickets, user directories, knowledge base articles, and service catalog items without logging in. snowpick tests both surfaces and tells you what's exposed, how severe it is, and gives you a curl command to prove it.
snowpick is intended for systems you own or have explicit permission to test. It should not be used against third-party ServiceNow instances without authorization.
Existing tools can detect parts of the ServiceNow access controls issue, but using the research during assessments still required manual work. Testers had to bootstrap sessions, choose candidate widgets, guess useful table and field pairs, check whether the Table REST API behaved differently, and decide how much evidence was enough without collecting more data than needed.
bsysop/servicenow checks a static list of table and field pairs through widget-simple-list. That approach is useful, but it can miss custom widgets, non-default tables, and Table REST API exposure.
snowpick turns that workflow into a repeatable check: it tests widgets and table APIs, discovers installed widgets where possible, separates row access from count-only behavior, and saves bounded evidence for review.
Bishop Fox Researchers
Emilio Gallegos is an offensive security researcher and adversarial operator at Bishop Fox. He specializes in application security and vulnerability discovery, earning notable recognition on the Apple Web Server Security Acknowledgements list and discovering CVE-2026-25087, a denial-of-service vulnerability in Apache Arrow.
snowpick is open source and built for the offensive security community. Star the repo, file issues, contribute templates, or fork it for your own research.