How to keep payload and query snippets for security researchers in 2026

Learn how security researchers can keep payload and query snippets in folders, check them before reuse, and compare tools for the job.

By SupaKeeper · 2026-11-04

SupaKeeper is published by LunarWerx, which makes some of the tools compared here.

Keep each payload and query snippet with a clear name, a folder, and a note on its purpose, and keep live secrets out of any collection you share. Copilot AI Productivity Suite is one option for keeping snippets organized, since its snippets can sit in nested folders and groups. ^[1] Other options, such as a notes file or a separate snippet tool, can be compared using the checks below.

Option	What it does	What to check
Copilot AI Productivity Suite	Keeps snippets in nested folders and groups. ^[1] Exports them as JSON or a share link. ^[1]	Check that your VS Code version meets the requirement. ^[1] Check whether the Free plan's 20 weekly insertions suit you. ^[1]
Notes file in your project	Plain text you keep yourself.	Check whether it keeps text exactly as written and who can open it.
Separate snippet tool	Details depend on the tool you pick.	Check its search, sharing and sync features against the needs listed above.

What you need before you start

Before you save any snippet, decide which ones you need to keep: payloads you want to reuse in a test, queries you run against a data source, and short notes on what each one is for. Keep a list of the editors and tools you already use, since a snippet is only useful where you can insert it.

Check the rules that apply to your work. Many teams have policies about where test material and access details may be stored, and a snippet collection can hold both. Remove live credentials, account names and any data from a real system before you keep a snippet, and mark anything that must stay restricted.

Decide who needs to see each snippet. Some are for you alone, while others belong to a team. That choice affects whether you keep them on one machine, export them, or share them with others.

Have your editor version current enough for the tool you pick, since requirements differ between tools.

Step by step

Collect the payload and query snippets you already have, from notes, files and older chats. Remove anything that holds a live secret.
Sort each snippet by its purpose, such as testing an input field, checking a log or reading a table. A clear purpose makes the snippet easier to find later.
Give each snippet a plain name that says what it does and what input it expects. Avoid names that only made sense on the day you wrote them.
Group related snippets together. Use folders for broad areas of work and groups for snippets you tend to use in one batch.
Mark any value that changes each time with a placeholder, so the snippet asks for the value rather than holding a fixed one. This keeps a template from being run with stale details.
Check each snippet before you reuse it, especially one copied from an earlier source. Confirm it still matches the target you are testing.
Keep a backup of the collection. Export it on a regular schedule and store the copy somewhere access is controlled.
Review the collection each month. Remove snippets you no longer use and rename any that have become unclear.

Tools that can do it

Copilot AI Productivity Suite is a VS Code extension that needs VS Code 1.116.0 or newer, and it is also on Open VSX, an extension library for editors such as Cursor, Windsurf and VSCodium. ^[1] You install it from the VS Code Marketplace as LunarWerx.copilot-suite. ^[1]

Its snippets can sit in nested folders, and you can bundle several into a group that is referenced all at once. ^[1] A placeholder such as name, or name with a default value, asks you for a value each time the snippet is inserted. ^[1] Typing '#copilotsuite /snippet_id' inserts the exact saved snippet template into the conversation. ^[1]

You can select several snippets to move, delete or insert together. ^[1] You can also pin up to five favorite snippets to the VS Code status bar. ^[1]

A bundled local helper makes your snippets and groups available to Claude Code, Codex CLI and other tools over a local connection. ^[1] If you turn on slash command export, each snippet is written out as a slash command file for Claude Code and Codex CLI, and the files stay in sync as you edit. ^[1]

If you sign in with an account using an emailed one-time code, your snippets, groups and settings sync across your machines. ^[1] The extension uses a proprietary licence, and the software is confidential to LunarWerx. ^[1]

Other options are a notes file kept in your project or a separate snippet tool. Compare each one against the job of keeping snippets organized and restricted, and check the points in the table before you choose.

Common mistakes to avoid

Avoid saving live secrets in a snippet and then sharing the collection. Remove keys and account details first, because a copy sent to a teammate cannot be recalled.

Avoid names that say nothing about purpose. A name such as test three is hard to use a month later, while a name that describes the input and the goal saves time.

Avoid keeping one long unsorted list. Folders and groups make it easier to find the right snippet without scrolling through everything.

Avoid reusing a snippet without checking the target it was written for. A payload or query that worked against one system may not be suitable for another.

Avoid sending a collection to people who should not see it. Check the scope of each file or link before you send it.

Avoid assuming the telemetry setting in VS Code matches your team's policy. Check the setting and the policy together before deciding what leaves your machine.

Frequently asked questions

How do security researchers keep payload and query snippets organized?

Give each snippet a name that says what it does, sort it into a folder for its area of work, and group snippets you use together. Mark values that change each time as placeholders so a snippet is not reused with stale details. Review the collection regularly and remove anything that holds live credentials or data from a real system. These habits apply to any tool, so they are a good first step before comparing options.

Can Copilot AI Productivity Suite keep snippets in folders?

Snippets can sit in nested folders, and you can bundle several into a group that is referenced all at once. ^[1] You can also select several snippets to move, delete or insert together. ^[1] Check whether this layout suits the way your collection is divided before you start moving snippets into it, and keep a copy of anything you cannot easily replace.

Does Copilot AI Productivity Suite send snippet content as telemetry?

While VS Code telemetry is on, the extension sends anonymous usage statistics, but never snippet content. ^[1] Your team may still have its own rules about telemetry, so check the VS Code setting and that policy together before you start keeping sensitive material in the collection.

Is Copilot AI Productivity Suite free to use?

There is a Free plan at $0 that allows 20 snippet insertions into a chat a week. ^[1] Premium costs $6.99 a month and has unlimited snippet insertions into a chat. ^[1] Choose the plan that matches how often you insert snippets, and check the current prices before you decide.

Can Copilot AI Productivity Suite share snippets with teammates?

You can export snippets as JSON or make a share link, and teammates can import it. ^[1] Before you send a file or link, check that the snippets hold no secrets or data from a real system, and that the people receiving them should see them. A shared collection is only as careful as its least careful copy.

There is a Free plan at $0 that allows 20 Copilot insertions a week. ^[1]

Try Copilot AI Productivity Suite

Sources

Copilot AI Productivity Suite's own description of itself (the product of this site's publisher)