Figma configuration hardening security checks
Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.
On Figma, Black Cat runs 3 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Figma connector needs.
Checks (3)
severity: high Webhook Endpoint Not HTTPS fix difficulty: easy #
Point webhooks at HTTPS endpoints to protect event payloads in transit
- Identify the webhook and its non-HTTPS endpoint URL
- Recreate or update the webhook to use an https:// endpoint
- Delete the insecure webhook after migration
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: medium Webhook Without Passcode fix difficulty: easy #
Set a passcode on webhooks so your receiver can verify event authenticity
- Update the webhook to include a passcode
- Verify the passcode on your receiving endpoint for each delivery
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: low Webhook Targets Raw IP Endpoint fix difficulty: easy #
Point webhooks at a named, TLS-validated host rather than a raw IP literal
- Identify the webhook whose endpoint is a bare IP address
- Replace it with a named host that presents a valid TLS certificate
- Re-scan to confirm the endpoint resolves to a trusted host
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10