TLDR Tech / Design
How Figma Stays Ahead of Vulnerabilities with Agents
Figma's security team built agentic systems that guard code generation, review pull requests, and audit its decade-old monorepo, all governed by one shared policy. Prioritizing precision over recall proved essential, since historical bugs only measure recall while trust requires developers see mostly valid findings—the team hit 70% precision before enabling PR comments, later reaching 80%. The resulting policy became a de facto threat model, powering hooks that steer secure code generation, adjudication passes that boost recall, and feedback loops that continuously refine detection from bug bounty reports and false-positive dismissals.
Read the full story