Security

Branches have their own credentials. BYOC stores replicas on infrastructure you operate; SnapshotDB Cloud copies source data to hosted infrastructure.

Minimal production footprint

snapshotdb reads from production over the engine’s replication and never writes to your application tables. On Postgres it adds its own publication, slot, metadata schema, and DDL event trigger, named snapshotdb_<name>. Removing a synced root attempts to release them; if source cleanup fails, follow the printed manual-cleanup instructions to avoid retaining WAL. On MySQL and MongoDB it creates nothing on the source.

Per-branch credentials

Roots that snapshotdb creates get a generated admin password, and every clone rotates to its own password on first start. Postgres accepts the password over TCP and trusts only its Unix socket (which snapshotdb itself uses); MongoDB runs with a keyFile and a generated root user. Treat branch URLs as secrets: they grant access to the copied data. Separate credentials do not replace network isolation or data redaction.

Server token

The BYOC control API uses an admin token (SNAPSHOTDB_TOKEN) presented as Authorization: Bearer; anyone with that token is an admin. The hosted gateway uses a separate server-side secret and derives each workspace from the signed-in GitHub account. Keep server tokens in a secret store, put the API behind a TLS terminator, and rotate by restarting with a new value.

Network boundaries

The filesystem sandbox does not isolate networking. Hosted source validation rejects private initial addresses and SRV discovery, but database clients can resolve DNS again or discover additional replica members. Operators must enforce egress restrictions that block metadata services, private infrastructure, and other tenants at connection time. Do not expose a shared hosted service on the strength of URL validation alone.

The native database proxies do not add TLS; SQLite query URLs use HTTP. An HTTPS control API does not encrypt those database connections. Keep them on a private network or behind an authenticated encrypted tunnel or compatible TLS gateway before transmitting credentials or source data.

Anonymization

Use a per-root branch_sql hook to redact or synthesize sensitive columns before handing a branch to an agent. Ordinary branches run initialization after cloning. Prepared snapshots run it during preparation, and prepared children inherit that data without rerunning the hook. It never touches the source. See Settings.

WAL retention

A stopped Postgres synced root keeps its replication slot, which retains WAL on the source until the root is started again or removed. status shows how much WAL the slot is holding. Preflight warns when max_slot_wal_keep_size is unbounded — set a bound so a forgotten root cannot fill the source’s disk.