How Figma stays ahead of vulnerabilities with agents

What this post added

This post details the technical evolution of Figma's agentic security system, specifically focusing on the pull request review component. Key contributions include: developing a shared policy that serves as a threat model, implementing mechanisms to measure and improve precision (author ratings) and recall (replaying known-bad commits), migrating the reviewer to a TypeScript service for better maintainability and observability, ablating prompts to leverage newer frontier models, and adding an adjudicator to improve recall by re-examining borderline dismissals. The post also outlines the metrics used (precision, recall, fix rate) and the evaluation framework for measuring recall with a corpus of real vulnerabilities.