The 7 Figma security checks Black Cat runs
Black Cat SSPM evaluates 7 security policies against your Figma configuration on every scan, classifies each finding by risk, and provides remediation steps. Below is the full list, grouped by category.
configuration
highWebhook Endpoint Not HTTPS
Point webhooks at HTTPS endpoints to protect event payloads in transit
mediumWebhook Without Passcode
Set a passcode on webhooks so your receiver can verify event authenticity
lowWebhook Targets Raw IP Endpoint
Point webhooks at a named, TLS-validated host rather than a raw IP literal
logging
lowAccount Not Org-Scoped (No Audit Visibility)
Configure an org-scoped Enterprise token so Figma activity/audit logs are collected
infoActivity Permission Change Event
Review file sharing/permission-change events captured in the activity log
infoActivity Member Role Change Event
Review member/role-grant events captured in the activity log
token governance
mediumStale API Token In Use
Review long-lived personal access tokens still making API calls