Security & Privacy

Architecture Overview

Local-First Design

Copy┌─────────────────────────────────────────────────────────┐
│                    YOUR MACHINE                          │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐  │
│  │ VS Code     │───▶│ SnapBack    │───▶│ .snapback/  │  │
│  │ Extension   │    │ Engine      │    │ Local Store │  │
│  └─────────────┘    └─────────────┘    └─────────────┘  │
│                            │                             │
│                            ▼                             │
│                   ┌─────────────┐                        │
│                   │ Metadata    │ (Optional cloud sync)  │
│                   │ Only        │────────────────────────┼──▶ Cloud
│                   └─────────────┘                        │
└─────────────────────────────────────────────────────────┘

What stays local:

• All source code and file contents
• Protection states (full file snapshots)
• Pattern learning data
• Session history

What can optionally sync (metadata only):

• AI tool usage patterns (anonymized)
• Risk event frequencies
• Aggregate statistics

Data Collection

What SnapBack Collects

Example: What Gets Sent (If Opted In)

Copy{
  "event": "protection_state_created",
  "timestamp": "2025-01-14T15:30:00Z",
  "metadata": {
    "ai_tool": "cursor",
    "ai_contribution": 0.78,
    "file_extension": ".ts",
    "lines_changed": 45,
    "risk_level": "medium",
    "session_duration_minutes": 12
  }
}

Notice: No file paths, no code, no personal data.

Detection Accuracy & Methodology

AI Detection Performance

Our detection system has been validated across diverse codebases:

Detection Methodology

SnapBack uses multiple signals to detect AI activity:

How it works:

1. Extension monitors editor events (local)
2. Analyzes change patterns (local)
3. Applies ML-based classification (local)
4. Stores attribution with protection state (local)

No code is sent to external services for AI detection.

Data Retention

Local Storage

Protection states are stored in .snapback/ with configurable retention:

Copy// .snapbackrc
{
  "retention": {
    "maxAge": "30d",           // Keep states for 30 days
    "maxStates": 1000,         // Maximum states per file
    "compressionLevel": "high" // Binary compression
  }
}

Default retention: 30 days or 1000 states per file (whichever comes first)

Cloud Sync (Optional)

If you enable cloud features:

• Metadata syncs with AES-256 encryption in transit
• Data retained for 90 days by default
• Can request deletion at any time
• GDPR-compliant data handling

Enterprise Security

Compliance

Enterprise Features

Air-Gapped Deployment

For maximum security, SnapBack can run fully offline:

Copy// .snapbackrc
{
  "offline": true,
  "telemetry": false,
  "cloudSync": false
}

In this mode:

• Zero network requests
• All processing local
• No analytics or telemetry
• Full functionality preserved

Vulnerability Disclosure

Reporting Security Issues

If you discover a security vulnerability:

1. Email: security@snapback.dev
2. Include: Description, steps to reproduce, impact assessment
3. Response: We’ll acknowledge within 24 hours
4. Timeline: Fix deployed within 7 days for critical issues

Bug Bounty

We offer rewards for responsible disclosure:

Open Source Components

SnapBack uses audited open-source libraries:

We regularly audit dependencies for vulnerabilities using automated scanning.

Transparency

What We Believe

• Your code is yours. We never access, read, or store your source code.
• Privacy by default. Cloud features are opt-in, local is the default.
• Minimal data. We collect only what’s needed for intelligence features.
• User control. You can export, delete, or disable data collection anytime.

Data Export

Export all your data at any time:

Copy# Export all local data
snap export --format json > my-data.json

# Export cloud data (if opted in)
snap cloud export --all

Data Deletion

Delete your data completely:

Copy# Delete local data
snap reset --all

# Delete cloud data
snap cloud delete --confirm

Frequently Asked Questions

Contact

For security questions or concerns:

• Security issues: security@snapback.dev
• Privacy questions: privacy@snapback.dev
• General support: support@snapback.dev

---