Security and local behavior

Snapbot passes the optional backup code to your debug setup route. Your app decides how to use it. Keep it out of the config: set backupCodeEnv to the name of an environment variable and pass a git-ignored env file with --dotenv:

pnpm capture --project-root /absolute/path/to/app --config ./snapbot.json --output ./out \
  --dotenv ./apps/example-app/.env.snapbot

# apps/example-app/.env.snapbot (git-ignored)
SNAPBOT_BACKUP_CODE=...

Variables already set in the environment take precedence over the file. A config may set backupCode or backupCodeEnv, not both; if backupCodeEnv names a variable that is not set, the capture stops before it starts. Snapbot redacts the code from displayed deep links and does not include it in summary.json. Use a dedicated screenshot account without elevated permissions if your app uses the code to log in.

Restrict access in your appCopy Anchor Link

SnapbotRoute redirects production builds to /; useSnapbotState does nothing outside __DEV__. These checks do not authenticate a caller in a debug build. Keep app-side authorization in your existing account flow, use a restricted screenshot account, and expose only UI state handlers that do not mutate real data. The lower-level SnapbotSetup component should be used behind an equivalent development-only boundary.

The setup code is passed through a simulator deep link. Snapbot redacts its own displayed setup URL and omits the code from the summary, but this is not a guarantee that arbitrary application logs, process diagnostics, screenshots, or user-supplied target URLs are secret-free. Never put credentials in screenshot deeplink values. Review run.log and PNGs before sharing them.

What capture changes locallyCopy Anchor Link

A capture starts Metro, runs expo prebuild --platform ios, runs pod install, and builds with Xcode into the app's ios/build/SnapbotDerivedData directory. It can create a dedicated simulator, boot it, install the app, approve the app's configured URL scheme, and request all permissions supported by simctl for that app. It changes appearance as configured and shuts down the simulator on cleanup. Camera permission cannot be pre-granted through that mechanism; avoid triggering camera prompts in screenshot flows.

Expo developer overlays are disabled for the launched process without changing saved developer preferences. App setup, navigation, and hooks execute your app code and can contact its backend. The CLI itself does not upload artifacts or call a hosted Snapbot service. The optional --exec executable runs with your permissions and environment; choose a trusted script.