Figma Policy & Guardrails
Overview
Automated guardrails for Figma API integrations: prevent token leaks, enforce scope minimization, validate webhook configurations, and catch common anti-patterns in CI.
Prerequisites
- ESLint or similar linter
- CI/CD pipeline (GitHub Actions)
- Pre-commit hooks infrastructure
Instructions
Step 1: Token Leak Prevention
repos:
- repo: local
hooks:
- id: no-figma-tokens
name: Check for Figma PAT leaks
entry: bash -c '
if git diff --cached --diff-filter=ACM -z -- . |
xargs -0 grep -lP "figd_[a-zA-Z0-9_-]{20,}" 2>/dev/null; then
echo "ERROR: Figma PAT found in staged files"
echo "Store tokens in .env files (which should be in .gitignore)"
exit 1
fi
'
language: system
pass_filenames: false
name: Figma Security Check
on: [push, pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Scan for Figma tokens
run: |
if grep -rP "figd_[a-zA-Z0-9_-]{20,}" \
--include="*.ts" --include="*.js" --include="*.json" \
--exclude-dir=node_modules .; then
echo "::error::Figma PAT found in source code"
exit 1
fi
- name: Check .env files not committed
run: |
if git ls-files --cached | grep -E '^\.(env|env\.local|env\.production)$'; then
echo "::error::.env file committed to repository"
exit 1
fi
Step 2: ESLint Rules for Figma
module.exports = {
meta: {
type: 'problem',
docs: { description: 'Disallow hardcoded Figma PATs' },
},
create(context) {
return {
Literal(node) {
if (typeof node.value === 'string' && /^figd_[a-zA-Z0-9_-]{20,}/.test(node.value)) {
context.report({
node,
message: 'Hardcoded Figma PAT detected. Use process.env.FIGMA_PAT instead.',
});
}
},
TemplateLiteral(node) {
for (const quasi of node.quasis) {
if (/figd_[a-zA-Z0-9_-]{20,}/.test(quasi.value.raw)) {
context.report({
node,
message: 'Hardcoded Figma PAT in template literal.',
});
}
}
},
};
},
};
Step 3: API Usage Policies
function validateFigmaRequest(path: string) {
if (path.match(/\/v1\/files\/[^/]+$/) && !path.includes('depth=')) {
console.warn(
'[figma-policy] Full file fetch without depth parameter. ' +
'Use ?depth=1 or /nodes endpoint for better performance.'
);
}
if (path.includes('files:read')) {
throw new Error(
'[figma-policy] files:read scope is deprecated. ' +
'Use file_content:read instead.'
);
}
}
function validateTimeout(options: RequestInit) {
if (!options.signal) {
console.warn(
'[figma-policy] Figma request without AbortSignal. ' +
'Use AbortSignal.timeout() to prevent hung requests.'
);
}
}
const MAX_REQUESTS_PER_MINUTE = 25;
let requestsThisMinute = ;
minuteStart = .();
() {
(.() - minuteStart > ) {
requestsThisMinute = ;
minuteStart = .();
}
requestsThisMinute++;
(requestsThisMinute > ) {
(
+
);
}
}
Step 4: Configuration Validation
function validateFigmaConfig() {
const errors: string[] = [];
const pat = process.env.FIGMA_PAT;
if (!pat) {
errors.push('FIGMA_PAT is not set');
} else if (!pat.startsWith('figd_')) {
errors.push('FIGMA_PAT does not have expected figd_ prefix');
}
const fileKey = process.env.FIGMA_FILE_KEY;
if (!fileKey) {
errors.push('FIGMA_FILE_KEY is not set');
} else if (fileKey.length < 10) {
errors.push('FIGMA_FILE_KEY seems too short');
}
if (process.env.FIGMA_WEBHOOK_ENABLED === 'true') {
if (!process.env.FIGMA_WEBHOOK_PASSCODE) {
errors.push('FIGMA_WEBHOOK_PASSCODE required when webhooks are enabled');
} else if (process.env.FIGMA_WEBHOOK_PASSCODE. < ) {
errors.();
}
}
(errors. > ) {
.();
errors.( .());
();
}
.();
}
();
Step 5: Audit Logging
interface FigmaAuditEntry {
timestamp: string;
action: string;
endpoint: string;
fileKey?: string;
status: number;
userId?: string;
}
function auditFigmaCall(entry: Omit<FigmaAuditEntry, 'timestamp'>) {
const log: FigmaAuditEntry = {
...entry,
timestamp: new Date().toISOString(),
};
console.log(JSON.stringify({ type: 'figma_audit', ...log }));
}
Output
- Pre-commit hooks catching token leaks
- CI pipeline scanning for hardcoded credentials
- Runtime policies enforcing performance best practices
- Configuration validation at startup
- Audit logging for compliance
Error Handling
| Issue | Cause | Solution |
|---|
| False positive on token scan | Test fixture contains figd_ | Exclude test fixtures directory |
| Policy blocks legitimate request | Too restrictive | Add exception list for specific paths |
| Startup validation fails | Missing env vars | Check deployment config |
| Audit log noise | Too many entries | Filter to write operations only |
Examples
Catch a hardcoded Figma PAT before it reaches a commit (Step 1 pre-commit hook):
echo 'const PAT = "figd_AbCdEf123456789";' > leak.ts
git add leak.ts && git commit -m "test"
Lint a violation of the API usage policy (Step 2 ESLint rule flags full-file fetches):
src/sync.ts
14:3 error Figma file fetch without depth parameter — use ?depth=1
or /nodes?ids=... (figma/no-unbounded-file-fetch)
Policy rule catalog and the audit-log event shape: references/api-usage-policies.md and references/audit-logging.md.
Resources
Next Steps
For architecture blueprints, see figma-architecture-variants.
