Skip to content
SnapchatSPlus

Legal

Security

Last updated: 2026-10-26. This text describes how the software works; it is not legal advice. The operator of snapchatsplus.com should review it with a qualified adviser and add their legal entity and contact details before publication.

How the app protects your PC

  • Allowlist only. The app can perform a fixed set of actions compiled into it. There is no endpoint that runs commands or scripts received from a website or server.
  • Loopback only. The local service listens on 127.0.0.1 and is not reachable from your network or the internet.
  • DNS-rebinding and CSRF protection. Requests must carry a loopback Host header, an allowed Origin and a bearer token; there are no cookies to abuse.
  • Pairing. Web access requires a 6-digit code shown on your PC; the resulting token is bound to the website's origin and revocable.
  • Local confirmation. Changes requested from the website must be approved in the app window.
  • Least privilege. The app runs as a normal user; only restore-point creation asks Windows for elevation through UAC.
  • Never weakens security. Antivirus, firewall, UAC, SmartScreen and Windows Update are only reported, never disabled.
  • Tamper-evident journal. The recovery journal is HMAC-signed; changes pause if it fails verification.

Code signing

The app is currently not code-signed. The download page states the signing status and SHA-256 of every published file.

Reporting a vulnerability

Please report security issues privately to the operator (security contact to be added, e.g. security@snapchatsplus.com once that mailbox exists). Do not include personal data in reports.