Snowpick: Open-source ServiceNow exposure scanner

Bishop Fox released Snowpick and a research write-up showing that misconfigurations in ServiceNow public surfaces (Service Portal widgets and the Table REST API) allowed unauthenticated sessions to retrieve or infer records from many instances — roughly 31% of 166 tested instances returned data or counts, exposing attachments, knowledge-base articles, ticket metadata, and other internal information. The issues are primarily access-control and configuration problems rather than new platform zero-days; the public release aims to accelerate remediation but also makes probing trivial for attackers.