Security disclosure principles

As a part of Figma’s security disclosure program, developers of plugins and widgets can voluntarily fill out a security disclosure form for their plugins and widgets. The form is intended to give users of plugins and widgets a better view into the data security practices of a given plugin or widget. After the disclosure form has been approved by Figma, logged-in users can view the disclosure in the Community listing of the plugin or widget.

This page includes:

• General security recommendations for plugins and widgets
• The questions and passing criteria for the voluntary security disclosure form

Data security recommendations

Data security is a complex and expansive topic. These best practices are general, high-level principles that plugins and widgets are asked to follow.

Protect users

Protecting users and user data is critical. Plugins and widgets must protect user data in the following ways:

• If a plugin or widget requires a user to authenticate, it should use a trusted security provider or method such as Auth0 or OAuth 2.0.
• If Personal identifiable information (PII) and user data derived from the Figma APIs must be sent outside Figma, you need to be transparent with your users and comply with all disclosure requirements under applicable law.
• If a plugin or widget must store data, where possible, the storage features provided by Figma should be used.

Use HTTPS

All network requests made from a plugin or widget to an external server should use HTTPS. Plugins and widgets should never use HTTP for network requests from Figma.

Restrict network access

Plugins and widgets should restrict ‌network access to only the domains that are required for the plugin or widget to run.

Questions and disclosure principles

This section contains the questions that appear on the security disclosure form for plugins and widgets, and the principles that Figma considers for the security disclosure program.