When a DDoS took Linear's site down, the team put a Figma file in its place

On October 13, 2022, a distributed denial-of-service (DDoS) attack took down Linear's homepage. The team's response wasn't a static status page or a defensive statement—it was a public Figma file that turned into an impromptu design review, live Q&A, and community event. Hundreds of people dropped in to explore the design file behind the company's recent website redesign, and the incident became a case study in turning an infrastructure failure into an opportunity for transparency.

From outage to open file

The attack hit the day after Linear shipped a major redesign of its website. The team initially suspected their own launch had caused the problem, but an incident call revealed the cause was a DDoS attack—a common occurrence for a company of Linear's profile. Their first priority was getting existing users back into the app, which they did by redirecting sub-page traffic to the login screen. But that left visitors who wanted to see the new homepage staring at a login form.

Co-founder Jori Lallo had another idea: put the Figma file that contained the redesign up as the homepage itself. Designers Paco Coursey and Edgar Ambartsoumian were hesitant at first—the file had been scrambled in the final 24 hours before launch and didn't reflect the shipped design. They quickly updated it to match the final version, made it public, and shared the link. Lallo pushed the redirect live sooner than expected, and visitors began streaming into the file before the designers had finished tidying it up.

"As people are showing up, I'm jumping in, copying over frames from our original Figma designs and using text fields to add titles that explain our decisions," Coursey said.

An accidental community event

What started as a stopgap became something more. Visitors couldn't edit the view-only file, but they could use Figma's cursor chat to ask questions. At one point, roughly 300 people were in the file simultaneously, and Ambartsoumian began writing down questions and answers directly in the file. The Q&A format gave the team a chance to add context they hadn't originally planned to share—alternate design directions, abandoned explorations, and notes from CEO Karri Saarinen about which paths he preferred or might revisit.

Some visitors were surprised to learn that Linear's web team is just three people: Julian Lehr (narrative and structure), Ambartsoumian (design), and Coursey (code). The team also preemptively addressed a detail they knew sharp-eyed visitors would notice: they don't name their Figma layers.

"Some things matter, some things don't. We aim for the output, not for process," Coursey said.

The only real security concern was whether visitors could access the company's component library or design system files. The team quickly changed access permissions, and the exposure was limited to the single public file.

A raw, honest look behind the curtain

The file remained active for days, not just hours. For Lehr, who missed the initial event while asleep in Berlin, the party was still going when he woke up, with 80 or 90 people browsing through the archive. The sustained interest pointed to something larger than a clever workaround.

"The file and the Q&A were very raw. If we had a PR person on our team, 90% of these things would probably not be published," Lehr said. The lack of polish was part of the appeal. It was genuine enough that some visitors suspected the DDoS attack was faked as a marketing stunt—a theory the team found ironic, given the circumstances.

What the team took away

The incident reinforced several lessons for Linear. First, the response to an attack matters as much as the prevention. The team's globally distributed engineers handed off mitigation duties across time zones, and the attack was eventually neutralized by traffic normalization. The homepage redirect to the Figma file stayed up simply because it was working well.

Second, the event validated Linear's philosophy of building in public. The company has published changelogs since before it was publicly available, but Lallo noted they had never found a way to share the design process as openly as they share engineering work—until that day.

The experience also sparked ideas about the future of web interaction. Lehr wondered why browsing a website couldn't feel more like being in that Figma file, with dozens of people exploring the same space simultaneously. "Maybe our next website shouldn't be a website, but a Figma file," he said. The team has since experimented with more collaborative formats, including "Polishing Season 2022," a live public backlog session where users could submit requests and watch the team work through them in real time.