Rolling Out Santa Without Freezing Productivity: Tips from Securing Figma’s Fleet | Figma Blog (opens in new tab)

Figma rolled out Santa, an open-source macOS binary authorization tool, across its laptop fleet without significantly disrupting employees. The company combined file access controls, monitoring mode, data-driven allowlists, and a staged deployment strategy to improve endpoint security while preserving productivity. Its experience shows that binary authorization works best as one layer of a broader, user-conscious security program.

Binary Authorization as Part of Endpoint Security

• Binary authorization limits devices to running approved applications, reducing the attack surface for malware-based attacks.
• It does not control scripts, extensions, plugins, or other non-binary code, so it cannot replace layered endpoint defenses.
• Santa supports:
  • Binary rules based on SHA-256 hashes for precise integrity checks.
  • TeamID rules for all applications signed by an Apple developer team.
  • SigningID rules for a specific developer identity and application.
  • Compiler/transitive rules for binaries produced by approved compilers.
  • PathRegex rules, which should be used cautiously because paths can be bypassed.
• Santa also provides file access authorization, allowing organizations to restrict which applications can access sensitive files.

Securing Browser Cookies First

• Figma initially used Santa’s file access authorization to protect browser cookies.
• Access was restricted to the browser application, reducing the risk of credential theft by malicious scripts or unauthorized processes.
• Because this protection had almost no effect on employee workflows, it provided a low-risk early success before introducing binary execution controls.

Building an Allowlist with Monitoring Mode

• Figma deployed Santa in monitoring mode across its fleet before blocking anything.
• Monitoring recorded binary executions and exposed how employees actually used software.
• The security team began with TeamID and SigningID rules for approved applications such as Zoom, Slack, Chrome, Notion, and GitHub.
• These broad signing-based rules covered most executions while allowing Figma to investigate exceptions and refine its policies before enabling lockdown mode.
• The collected data helped the team prepare for blocking unapproved binaries with minimal disruption.

Balancing TeamID and SigningID Rules

• Figma’s allowlist design required weighing broader publisher-based trust against more narrowly scoped application identities.
• TeamID rules can efficiently authorize applications from a trusted developer, while SigningID rules provide tighter control over specific products or signing identities.
• Choosing the appropriate rule type was an important part of creating a secure allowlist that would not unnecessarily block legitimate work.

Figma’s approach recommends starting with protections that are nearly invisible to users, gathering real execution data in monitoring mode, and only then progressing toward lockdown with carefully scoped rules and staged rollout controls.