---
title: Reports Should Not Be Made Public
description: "Impact Area Security Severity High Affected Element Report ## Rule ID **SN-0406** ## Impact When a report is published, the generated URL is public by default, it means the report data could be exposed to anyone including people who are not…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/servicenow-rules/reports-should-not-be-made-public/"
updated: "2025-03-21"
category: Rules
---

# Reports Should Not Be Made Public

Impact Area

Security

           Severity

High

           Affected Element

Report

## Rule ID

**SN-0406**

## Impact

When a report is published, the generated URL is public by default, it means the report data could be exposed to anyone including people who are not users. Reports are available until they are unpublished.

## Remediation

Share reports using Groups, Users and Roles. To make a report available only to logged in users, set its Sharing setting to Everyone, but do not publish it.

### Time to fix

15 min

## References

This rule is linked to [Common Weakness Enumeration CWE-284 Improper Access Control](https://cwe.mitre.org/data/definitions/284.html).