Our approach to security at speed | Figma Blog (opens in new tab)

Figma’s security team aims to help teams ship quickly without compromising safety. Its approach combines early risk assessment, reusable technical controls, decentralized decision-making, and transparent collaboration rather than rigid mandates. The goal is to make security an enabler of product development.

Systematically Assessing Risk

• Security reviews upcoming features and workflows to identify risks early.
• Teams use a three-question “ThreatJam” survey before security office hours, held three times weekly.
• For FigJam’s rich link previews, the team identified risks including:
  • SSRF, where attackers could request internal Figma resources.
  • Denial-of-service attacks against linked websites.
  • Malicious HTML that could deface or execute code within FigJam.
• Figma isolated link scraping and parsing in a cloud function running on a separate virtual machine and network.
• Additional protections included:
  • Cloud-function rate limiting.
  • Temporary storage of scraped data.
  • Restricting requests to standard HTTP and HTTPS ports.
  • Limiting parsed HTML to approved tags.
  • Reusing existing plugin and widget security mechanisms.

Reusable and Decentralized Security Solutions

• Security provides customized guidance while avoiding centralized approval processes.
• The team builds reusable libraries, frameworks, documentation, and security patterns.
• Solutions developed for one product can serve as case studies for other engineering teams.
• Office-hours notes are shared across Figma so teams can understand security reasoning and apply it independently.
• This model allows security practices to scale as the company grows.

Defending Against Phishing and Information Disclosure

• Figma uses technical controls to protect employees, devices, and internal data.
• Access to internal sites requires a passwordless second factor scoped to the specific site.
• New employees receive hardware authenticator keys.
• Employees are also encouraged to register biometric authenticators such as Touch ID or Windows Hello.

Figma’s model demonstrates that security can move at development speed when teams assess threats early, isolate risky functionality, automate defenses, and share solutions broadly. Companies seeking a similar approach should prioritize reusable controls and security collaboration over process-heavy gates.