Security

This page describes how Claude Design Importer protects accounts and data, and how to report a vulnerability. We are a small independent product, so we would rather state plainly what we do and what we do not than imply more than is true.

1. Reporting a vulnerability

Email hello@claudefigmaplugin.com with the subject line starting in SECURITY. Include what you found, how to reproduce it, and what impact you believe it has.

• We acknowledge every report within 3 business days.
• We tell you our assessment and, when we accept the report, our intended fix and timeline.
• We ask that you give us a reasonable window to fix the issue before disclosing it publicly, and that you avoid accessing, changing, or deleting data that is not yours while investigating.
• We do not run a paid bug bounty. We will credit you by name on this page if you want the credit.

2. What is in scope

• The API at claudefigmaplugin.com.
• The Chrome extension and the Figma plugin published under the name Claude Design Importer.
• This website.

Out of scope: our vendors' own infrastructure (Vercel, Neon, Stripe, Resend), reports produced only by automated scanners with no demonstrated impact, and issues that require an already-compromised device or mailbox.

3. How accounts are protected

There are no passwords. Sign-in uses a 6-digit code sent to your email address. We never create, store, or transmit a password.

• The code is generated with a cryptographic random number generator and stored only as a SHA-256 hash — never in plain text.
• It expires after 10 minutes and is invalidated after 5 failed attempts.
• Codes are compared in constant time, so a wrong guess reveals nothing through timing.
• Requests are limited to 5 codes per email address every 15 minutes.
• The session token is 256 bits, stored only as a hash, and revocable. It travels as a Bearer header over HTTPS. We use no cookies, so there is no ambient credential and no CSRF surface.

4. How your content is handled

• A deck is captured only when you click Capture. Neither surface reads anything in the background.
• The Figma plugin never reads your Figma file. It only creates layers. It does not enumerate, read, or send anything that was already in your document.
• Captured decks are deleted 7 days after capture, and you can delete any of them from your history at any time.
• We store no card data. Payment happens on Stripe's hosted checkout; we keep only the Stripe customer identifier.

5. What we do not have

We hold no security accreditation — no SOC 2, ISO 27001, PCI DSS, or similar. We do not employ a dedicated security team. What we do instead is keep the surface small: one API, one database, no third-party SDKs inside the extension or the plugin, no analytics in either, and the minimum personal data we can operate with — your email address.

6. Contact

Security reports and questions about this page: hello@claudefigmaplugin.com.