Security scans for custom templates

End-of-life notice

The legacy Provider and Consumer Data Clean Rooms are being discontinued. Migrate to the Collaboration API using the migration tool before the dates below.

  • 2026-10-01: New legacy clean rooms may not be created via the web application user interface.
  • 2027-02-01: The web application user interface will no longer be accessible, and new legacy clean rooms may not be created via the API.
  • 2027-06-01: Legacy clean rooms will no longer be accessible. Only the Collaboration API can be used.

Snowflake runs a security scan on custom templates every 30 minutes to identify Jinja code that is susceptible to a SQL injection attack.

Prerequisites

  • To enable the custom template security scan, you must log into the clean rooms UI for that account at least once.

  • The PRIVACY_AND_SECURITY_SCANNER task must be running.

    To see if the task is running in the Tasks page in Snowsight:

    1. In the navigation menu, select Transformation » Tasks.

View security scan results

Snowflake saves security scan results to the SAMOOHA_BY_SNOWFLAKE_LOCAL_DB.PUBLIC.TEMPLATE_SCANNER_RESULTS table in the provider’s Snowflake account. This table is present only if the previously listed prerequisites are satisfied.

To view results of security scans:

  1. Sign in to Snowsight.

  2. Use the database object explorer in Snowsight or a SQL query to view the security scan results:

    1. In the navigation menu, select Catalog » Database Explorer.
    2. Navigate to SAMOOHA_BY_SNOWFLAKE_LOCAL_DB » PUBLIC » Tables » TEMPLATE_SCANNER_RESULTS.
    3. Select Data Preview.