What stops an agent, and what it cannot reach.
Mechanisms, not assurances. Every line below is something the software does, and every one links to the page that explains how. Where a guarantee has a test holding it up, the test is named.
A sandbox you did not have to switch on
On macOS, commands run confined to the working directory and temp with no configuration — Seatbelt enforces it. On Linux the same confinement needs bubblewrap installed and able to open a user namespace. Where neither holds the agent runs unconfined and says so at startup: the level it reports is always the one in force, never the one you asked for. On such a host --sandbox-image runs every tool inside an ephemeral Docker container with the working directory mounted at /workspace, destroyed when the session ends, and --require-sandbox refuses to start rather than proceed unprotected. Dangerous shell patterns are refused outright on every platform, and the flag that lifts confinement is called --danger-full-access, which is a warning and not a joke.
What it can do without askingYour rules add to the guards, they do not replace them
A permission you grant is merged on top of the built-in policy, so one convenient allow cannot disarm the guard on sudo or a fork bomb. That property is held by a test named for it, not by a comment: user_rules_do_not_disarm_default_guards.
Changing the rulesThe gate fails closed
A dangerous action waits for a person. Only an explicit approval lets it through: a refusal, a timeout and a dropped connection all deny. The agent is told which of the three happened, so a transcript never reports a timeout as somebody's decision.
Approvals and safetyRead-only until you decide otherwise
Plan mode refuses every tool that writes a file or runs a command — in the dispatcher, below the model. It is not a promise the model makes to itself; a model that decides to edit anyway receives an error.
Act and Plan modesNothing it does is unrecoverable
Before each destructive action the agent snapshots your working tree, up to twenty checkpoints a session. /rewind puts the last one back — and the rewind is itself reversible, because it stashes the current state first.
Undo with checkpointsTools run inside a capability sandbox
A tool is a WASM component with declared capabilities and enforced budgets: memory, CPU, a wall-clock timeout, an allowlist for the environment variables it may read, and a guard against forged server-side requests, re-checked on every redirect hop rather than once at the start.
Capabilities and the sandboxThe work happens on your machine
Snaga Code executes in your directory, with your toolchain and your credentials. The web and the mobile app send it work and receive results; they are a remote control, not an execution environment.
The agent on your machineReleases are signed
Every published binary ships with a cosign signature and certificate, and the release carries a sha256sums file. The installer verifies the checksum before it puts anything on your PATH.
Install and first run
What this page does not claim
No certification is claimed here, because none is held. There is no SOC 2 report, no ISO 27001 certificate and no penetration-test letter to hand you today. When one exists it will appear on this page with its report attached, and not before.
The data-protection terms that do exist are written down: the Data Processing Agreement, the Privacy Policy and the Acceptable Use Policy.
Found something we should know about? Write to us through contact and say it is a security report — those are read first.