Encrypted connections
The BugSnaps website and hosted MyPentest API use HTTPS. Connections to Firebase also use HTTPS/TLS to protect data in transit.
Security & trust
How we protect your assessment data.
A clear view of the safeguards behind BugSnaps and MyPentest, the infrastructure we use, and the scope of our security assurances.
Ask a security question
Last reviewed: October 16, 2026
Data protection
Protection at each step.
Encryption at rest
Firebase provides encryption at rest for Firebase Authentication and Realtime Database, where account information and saved assessment reports are stored.
Account isolation
Saved reports and scan progress are organized by account. Firebase database rules restrict customer access to the matching signed-in user, and the API verifies Firebase identity tokens.
Encryption at rest is managed by our providers. MyPentest processes assessment data to run tests and generate reports; authorized administrative access remains possible. See Firebase's encryption documentation for the provider's scope.
Infrastructure assurance
Built on established cloud providers.
Our core hosting and identity providers publish their own security and compliance information. Follow the source links to review their scope and report access requirements.
| Provider | Used for | Provider assurance |
|---|---|---|
| Vercel security information (opens in a new tab) | Website hosting and API proxy | SOC 2 Type II attestation |
| Render security information (opens in a new tab) | Hosted MyPentest assessment engine | SOC 2 Type II report |
| Google Firebase security information (opens in a new tab) | Authentication and saved assessment data | SOC 2 evaluation; provider-managed encryption |
Provider assurance has a defined scope. BugSnaps has not completed its own SOC 2 examination. Infrastructure providers' reports do not extend an independent audit opinion to our application, configuration or business operations.
Your account and reports
Access follows your account.
Firebase Authentication handles sign-in. The hosted API verifies identity tokens and checks the assessment owner. Saved reports, exports and scan progress use account-scoped database paths protected by Firebase access rules.
You can delete saved assessment reports from your dashboard. For account deletion or a wider data request, contact aryan@bugsnaps.in. Provider logs and backups have their own retention; deleting a dashboard report does not promise immediate removal from every provider system.
Read our privacy policyAuthorized testing
Scope comes before a scan.
MyPentest requires account-bound DNS TXT domain verification. Test only systems you own or have written permission to assess, and use dedicated test accounts for authenticated testing.
Assessment safeguards and limitsAssurance & transparency
Clear answers for your security review.
Is BugSnaps SOC 2 certified?
BugSnaps has not completed its own independent SOC 2 examination. Vercel and Render publish SOC 2 Type II assurance information, and Firebase documents SOC 2 evaluations for its services. Those provider reports cover their services and controls; they do not certify BugSnaps or the MyPentest application.
Can another customer read my assessment reports?
Customer access to saved reports, exports and progress is restricted by Firebase rules to the matching authenticated account. The hosted API also checks the verified account identity when accessing assessments. This is logical access isolation on shared infrastructure, rather than a separate database for every customer.
Is my assessment data end-to-end encrypted?
MyPentest uses encrypted transport and provider-managed encryption at rest. It is not an end-to-end encrypted service: the assessment engine processes assessment data, and authorized administrative or infrastructure access is a separate privileged access path.
Does BugSnaps have a CSA STAR listing?
BugSnaps does not currently claim a CSA STAR listing or certification. STAR Level 1 is a published self-assessment, rather than an independent audit. We will link to an accepted registry entry if one becomes available.
Security contact
Found something we should investigate?
Send a private vulnerability report with the affected URL, reproduction steps and the minimum evidence needed. Avoid including other customers' data or live credentials.