Security review for SecOps teams
Technical details pulled directly from the extension source code. Exact permissions, API calls, authentication flow, external connections, and storage — everything needed for an informed approval decision.
Download security review document
Plain-text version of this page for offline review or internal circulation
Summary
Read-only
All ServiceNow API calls use GET. No writes, deletes, or modifications to your instance.
No data leaves your network
API calls go from your browser directly to your ServiceNow instance. No Sourdough server in the path.
Session-scoped auth
Uses your existing browser session. The g_ck token lives in memory only - never written to disk.
Chrome permissions (from manifest.json)
Manifest version 3. These are the complete declared permissions.
activeTab
Reads the current tab URL to determine which ServiceNow instance you're on. No other tab data accessed.
storage
Stores your saved instance list (name + URL only) in chrome.storage.sync. No instance data stored.
tabs
Sends a message to the active tab's content script to request the g_ck token. Read-only.
host_permissions: https://extensionpay.com/*
Required for the ExtensionPay payment processor (trial/subscription management). No ServiceNow data flows here.
Note on content_scripts: <all_urls>
The content script runs on all URLs, but its only function is to listen for a message from the popup asking for the ServiceNow g_ck token. It reads window.g_ck and returns it via postMessage. On non-ServiceNow pages, window.g_ck is undefined and nothing is returned. No page content is read.
Not requested
Authentication flow
Sourdough uses ServiceNow's existing g_ck CSRF token - the same token ServiceNow's own UI uses for API calls.
Popup opens
User clicks the extension icon. The popup sends a message to the active tab's content script via chrome.tabs.sendMessage.
Script injection
The content script injects gck-accessor.js into the page context (CSP-compliant script tag). This script reads window.g_ck.
Token returned via postMessage
gck-accessor.js sends window.g_ck back to the content script via window.postMessage with type SOURDOUGH_GCK_RESPONSE. 3-second timeout if not available.
Token used in API header
The popup uses the token as the X-UserToken header on all ServiceNow API calls. Token is held in memory only, never written to storage.
Exact fetch signature (from servicenow.js)
const headers = {
'Accept': 'application/json',
'Content-Type': 'application/json',
'X-UserToken': g_ck // session-scoped CSRF token
};
fetch(url, {
method: 'GET', // all calls are GET
headers,
credentials: 'include' // browser session cookies
});ServiceNow API endpoints called
All calls are GET-only. All calls go to the user's own ServiceNow instance. All responses are rendered in the extension panel and discarded — never forwarded anywhere. Results are limited to 100-500 records per call using sysparm_limit.
/api/now/table/incidentActive incidents — priority, state, assignment/api/now/table/change_requestChange requests by state/api/now/table/taskAssigned tasks and SLA data/api/now/table/task_slaSLA stage breakdown/api/now/table/sys_outbound_http_logOutbound HTTP calls — error codes, endpoints/api/now/table/ecc_queueECC/MID server queue status/api/now/table/ecc_agentMID server health/api/now/table/sysapproval_approverApproval queue/api/now/table/cmdb_ciCMDB configuration items/api/now/table/cmdb_ci_computerServer/computer CIs/api/now/table/sys_propertiesServiceNow version detection (glide.war only)/stats.doInstance health metrics (HTML page, read-only)/replication.doReplication status (read-only)All calls respect the authenticated user's ACLs. If the user cannot read a table, Sourdough receives a 403 and shows "no access."
External connections
Two external connections exist. Neither involves ServiceNow data.
extensionpay.com
payment processorExtensionPay manages trial periods and paid subscriptions. The background service worker runsextpay.startBackground()which listens for payment webhooks from extensionpay.com. Origin is validated:event.origin !== 'https://extensionpay.com' events are rejected. Data stored: installation timestamp, trial start date, subscription status. No ServiceNow data involved.
Chrome Web Store update server
managed by GoogleStandard Chrome extension update mechanism managed by Google. No Sourdough-controlled server involved.
No analytics, telemetry, crash reporting, or user tracking. No ServiceNow data is sent to any external server.
Data storage
chrome.storage.sync
Two keys only:
instances - Array of saved ServiceNow URLs and display names (user-configured)
currentInstance - Currently selected instance name and URL
localStorage (browser cache)
API responses are cached locally to reduce calls. All prefixed frontdoor_cache_*. TTLs:
Cache is cleared on instance switch and via a manual button in the UI.
Memory only (never persisted)
The g_ck authentication token. Held in memory during the popup session. Not written to any storage API.
Enterprise deployment
Force-install via Google Admin Console
Add extension ID bbalpiojmggfbkjlnldlkmmailaakpbh to ExtensionInstallForcelist to push to all managed devices.
Allowlist
If your policy blocks extensions by default, add the extension ID to ExtensionInstallAllowlist.
Version pinning
Chrome Enterprise policies support pinning to a specific version if you need to control update timing.
Extension ID
bbalpiojmggfbkjlnldlkmmailaakpbh — consistent across all Chrome Web Store installs.
Distribution
Distributed exclusively through the Chrome Web Store. All updates go through Google's review process before reaching users. No sideloading required or supported.
Questions from your SecOps team?
Reply to any email in the sequence, or reach out directly. Happy to provide additional documentation, answer specific questions, or get on a call with your security team.
Sourdough is an independent Chrome extension. Not affiliated with, endorsed by, or sponsored by ServiceNow, Inc.