- In June 2026, ServiceNow disclosed that attackers used an API endpoint that should have required a login but was open to the public internet, and reached customer data across enterprise deployments.
- The article argues that moving to SaaS does not make a company secure, because flaws in application design, such as unprotected API endpoints, stay with the vendor's software.
- The article says organizations building their own apps should pick frameworks that enforce authentication by default, like FastAPI, rather than relying on developers to remember it.
The API That Was Not Supposed to Be Public
In June 2026, ServiceNow disclosed a security incident where attackers exploited an unauthenticated access flaw in a vulnerable API endpoint. The endpoint — which should have required authentication — was accessible from the public internet without credentials. Attackers used it to access customer data across enterprise ServiceNow deployments.
ServiceNow is the backbone of IT service management for Fortune 500 companies, government agencies, and healthcare systems. It manages incident tickets, change requests, asset inventories, and employee workflows. An unauthenticated API endpoint in ServiceNow is a direct window into the operational data of some of the world's most sensitive organizations.
SaaS Does Not Mean Secure
The enterprise migration playbook of the 2020s was straightforward: move from on-premise to SaaS. Let the vendor handle security. ServiceNow, Salesforce, Workday — these platforms are supposed to be more secure than self-hosted alternatives because the vendor manages the infrastructure, applies patches, and monitors for threats.
The ServiceNow breach reveals the gap in this assumption. The vendor manages the infrastructure, but the API surface is the new attack vector. A SaaS platform with unauthenticated endpoints is not more secure than a self-hosted application with unauthenticated endpoints. The vulnerability is in the application logic, not the infrastructure. Moving to the cloud does not patch bad API design.
The API Perimeter Problem
Modern web applications — whether SaaS or self-hosted — live and die by their APIs. Every microservice, every integration, every webhook is an API endpoint that must be authenticated, authorized, and rate-limited. ServiceNow's incident is a reminder that API security is not a solved problem, even for the largest enterprise software vendors.
WebPulse's framework evaluation increasingly focuses on API security posture. Frameworks that enforce authentication by default (FastAPI with dependency injection, Rust's Actix with extractors) produce fewer unauthenticated endpoint bugs than frameworks where authentication is an optional middleware layer. The ServiceNow breach is what happens when authentication is optional and someone forgets to apply it.
Framework Choice as API Security
For organizations building their own applications — not just consuming SaaS — framework choice directly determines API security posture. FastAPI's dependency injection system makes it difficult to accidentally create an unauthenticated endpoint: dependencies are explicit, typed, and enforced by the framework. Django REST Framework's permission classes default to authenticated access. Express, by contrast, has no default authentication — every endpoint is public unless the developer adds middleware.
The lesson from ServiceNow is not that SaaS is bad. It is that API security requires framework-level enforcement, not developer discipline. The frameworks that make secure defaults easy and insecure configurations hard produce fewer ServiceNow-style incidents. The frameworks that leave security as an exercise for the developer produce endpoints that should be authenticated but are not.
Produced by the WebPulse Newsroom with AI assistance and checked against our data by our editorial review. How we use AI.
