Great questions!

Let's address them one by one.

1. I discuss security in-depth in this article. The gist is that you never expose or connect to production. It works the other way around which is an important distinction. It means any surface area to attack is significantly reduced/removed. I'd also like to add that Lightrun is used on Fortune 50 companies, banks, etc. where security and performance requirements are very extreme.

2. Snapshots work pretty much like a breakpoint would. Only they don't stop. This requires a bit of a mind shift. For obvious reasons you can't use a breakpoint in production since a server might get stuck in the middle of debugging.

3. Performance is always impacted. We measured Lightrun and found that when no actions are used the overhead is on the scale of 0.5% and when actions are added it's around the 7% overhead for a system under heavy load. Lightrun throttles action when they take too much CPU and you can tune the amount of CPU allocated to it. The default is pretty conservative so you shouldn't feel a performance impact regardless of what you do.