ServiceNow Scoped Applications Zurich

Apply these rules to scoped applications running on the ServiceNow Zurich family. Use the instance's actual patch level, JavaScript mode, installed plugins, and security configuration when selecting APIs and controls.

Release and runtime boundaries

• Verify the Zurich build and install the applicable supported security patches and hotfixes; a family name alone does not establish that a security fix is present. Check the official patch listing and customer security advisories before deployment.
• When the application is built from source with the ServiceNow SDK, add the @servicenow/sdk release line that supports the instance's family and any third-party npm libraries through npm, so the committed package-lock.json records them and Dependabot or Renovate keeps them current, and take any exact SDK version from the npm registry or leave a placeholder that fails the build. Take family, patch, and hotfix identifiers from ServiceNow's patch listing or the advisory itself, never from memory.
• Use the ServiceNow server-side JavaScript engine and scoped APIs. New scoped applications default to ECMAScript 2021 (ES12), which implements a subset of ES2021 and ES2022; do not assume Node.js, browser APIs, or complete ECMAScript support.
• Check both application and individual-script JavaScript modes. Test existing ES5 Standards or Compatibility scripts before changing their mode, including authorization and error paths.
• Assess the installed Security Center version and effective property values. Zurich's bundled Security Center 3.2 uses hardening baseline 7.0; a baseline score