We’re all set and ready to go, but…
ServiceNow is - correctly - taking their audit responsibility seriously and checking squid before approval for the app store thoroughly. Two issues have come up:
- We intentionally use GlideRecord instead of GlideRecordSecure to retrieve data thereby ignoring ServiceNow ACLs. This approach violates standard ServiceNow guidelines. But respecting ServiceNow ACLs is actually dangerous in most use cases where squid would be used. See ServiceNow ACLs from a data export perspective for details on why we think so. We’re on our way to finding a resolution, but we’re not there quiet yet.
- squid is a complex beast - internally, not the usage
. In order to build squid we utilize modern JavaScript/Typescript tooling (static type checking, clean class structure, real git integration, etc.). This requires the use of an industry standard build process including a typescript compiler and terser along with a few other tools. This results in code that is … ahh … ‘different’ from what ServiceNow is used to.
These two issues have made the audit process slightly more intense than what was expected.