ServiceNow security articles

Written from the attacker's side and verified against a live ServiceNow instance rather than generated from training data. Each article carries the read-only detection script that produced the finding, the remediation, and the regulatory citation an auditor will ask for.