Security as an accelerator, not a gate

Figma’s security team operates with a clear mandate: help product teams ship features securely without slowing down development. The operating model that supports this is built on transparency, reusable solutions, and earning trust—rather than imposing mandatory processes.

The team’s approach is proactive. They review upcoming features and workflows to spot potential risks and connect with the relevant teams early. A big part of that rhythm is hosting security office hours three times a week. Before those sessions, product teams fill out a three-question survey called “ThreatJam” in a FigJam file that gives the security team context to assess risk—from compromised vendor components to misconfigured cloud resources.

When the FigJam team was building rich previews for links, they needed to fetch metadata from external sites to display a tile with an icon, description, and more. They reached out to security for guidance. After reviewing their survey responses and discussing the plan in office hours, the team identified three key threats:

  • Entering internal Figma server links to leak internal resources—a server-side request forgery (SSRF) vulnerability
  • Abusing Figma’s resources to flood a linked site with requests, causing a denial of service (DoS)
  • Linking to sites with malicious HTML that could deface or run code in FigJam

The recommendation was to isolate the code that scrapes and parses user input inside a cloud function—a separate virtual machine on a separate virtual network. This isolates the processing from the rest of Figma’s infrastructure, neutralizing SSRF attacks. For the other threats, they relied on built-in rate limiting, short data retention for scraped content, and restricting requests to standard HTTP and HTTPS ports. Parsing was limited to specific HTML tags, reusing existing security work from the plugin system.

The security team didn’t just hand over advice. They provided example code and documentation to get the team started and reviewed what was written afterward. The result was a secure feature that shipped on schedule.

Scaling through reuse and shared context

This pattern reflects the team’s goal of decentralizing security decisions. Rather than solving the same problem repeatedly, the team builds libraries, frameworks, and mental models that other teams can adopt. After partnering with the FigJam team on the metadata fetching solution, the approach became a case study that other engineering teams have reused for similar features.

Office hours notes are shared broadly across the company, giving everyone insight into the reasoning behind security recommendations. The idea is to make security an enabler—context and reusable solutions should reduce friction, not add it.

Phishing defense and document control at scale

The security team also protects a growing internal user base without expanding manual oversight. For phishing resistance, Figmates use password-less second-factor authentication for internal sites, scoped per site. New hires receive hardware authenticator keys, and biometric options like Touch ID and Windows Hello are registered on their devices. The flow uses FIDO2 / WebAuthn: the site issues a challenge, the user’s authenticator prompts for a touch or tap, and a signed response is validated—a faster interaction than typing passwords and codes, with stronger phishing defenses.

Document security is handled through automation as well. Since the team anticipated that employees might unintentionally make internal documents public, they wrote a bot that watches for documents with public sharing enabled. When that happens, the person who shared it gets a Slack message asking them to confirm the action and providing directions on how to restrict access. This bot replaced a slow, manual process that relied on outreach and training, turning it into an automated control that both protects and educates.

What’s next

Figma has doubled in size over the past year, and so has the security team. The team continues to build on its strengths: writing code, leveraging APIs, and preferring serverless functions for internal tooling to keep operational toil low and avoid manual alert reviews. Beyond the initiatives described, they manage the bug bounty program, run penetration tests, monitor incidents and near misses, and develop static and dynamic analysis tools.

The core philosophy—build systems and patterns that other teams can own—is meant to scale with the company. The approach is designed to evolve as Figma grows, keeping the platform secure while development velocity stays high.