What the extension can reach
Snags asks for access to websites once, when you start your first audit, because Chrome only lets an extension screenshot a tab with that access. It still reads nothing from a site until you start an audit there, and it adds its toolbar only to that site's pages.
To offer to start an audit, the side panel reads the current tab's address and title. Nothing from it is kept.
What Snags records during an audit, and what it masks, is in What gets captured.
Who can open an audit
An audit link opens for anyone who has it, without an account. That's what makes it easy to send, so treat a link like the content in it.
- On Pro and Team, a link can require a password. Coding agents pass it over MCP.
- Free links expire after 7 days.
- Replies, assignees and who checked a fix are seen only by the audit's author and the workspace members who can see its site, never by others with the link.
- In a workspace, clients see only the sites they were given.
Signing in
There are no passwords. You sign in with a link sent to your email address, in the extension and on app.snags.com alike. Sign-in pages are protected against automated abuse, and sign-in emails are limited to 5 per address per hour.
On the web, a sign-in lasts in an HttpOnly cookie, and requests that change something must come from Snags' own site. Sign-ins end after 90 days without use.
Trackers and agents
- Tracker connections are encrypted on Snags' servers. Linear and Jira connect with OAuth. GitHub connects through a GitHub App, so Snags reaches only the repositories you pick.
- An issue always uses the connection of the person who creates it, so a shared link can't be used to file into someone else's tracker.
- Access tokens for coding agents act as you, only on audits you work on. Snags keeps only a hash of each one, and you can revoke them at any time.
Data handling
Secrets are swept out in the browser, before anything uploads: credential headers, tokens, keys, card numbers and email addresses in errors and requests. Uploads are checked against size limits as they arrive.
Screenshots, replays and errors stay in your browser until you publish. See the compliance guide for using Snags on pages with real people's data, and the privacy policy for what's kept and for how long.
Report security concerns to privacy@snags.com.