How Figma Stays Ahead of Vulnerabilities With Agents | Figma Blog
figma.com · 3,925 words · saved by 1 readers
For the past year, agents at Figma have guarded code as it's written, reviewed every pull request, and audited a decade-old monorepo, all on one policy.
Precision is the share of reported findings that are real vulnerabilities. High precision implies low false positives. Recall is the share of real vulnerabilities the system catches. High recall implies low false negatives. Pointing coding agents at the codebase and asking them to find vulnerabilities is simple. Getting the precision and recall an organization needs is still hard engineering: How many findings are legitimate, and how many actual bugs does the system catch? This post walks through how we approach precision, recall, and trust when it comes to running agentic security for…
saved by
related reading
- Vulnerability Research Is Cooked - Quarrelsomesockpuppet.org
- Why We Built Our Own Background Agentbuilders.ramp.com
- Demystifying evals for AI agents \ Anthropicanthropic.com
- Auto-review of agent actions without synchronous human oversightalignment.openai.com
- I built an AI code review agent in a few hours, here's what I learnedsourcebot.dev
- A Practical Approach to Verifying Code at Scalealignment.openai.com
- Now – Updates from the Linear teamlinear.app
- Thoughts on slowing the fuck downmariozechner.at
- Treat Agent Output Like Compiler Output | Skipskiplabs.io
- AI is approving our pull requests: Here’s how we made it safeintercom.com
- AuditAgentauditagent.nethermind.io
- Best practices for coding with agents · Cursorcursor.com