# Security

> How the Figma to shadcn/ui plugin handles your designs, API keys, and generated code — what is sent, what is stored, and how to report a vulnerability.

Canonical: https://www.shadcndesign.com/docs/plugin-security

## Overview

The Figma to shadcn/ui plugin is built so that we never become a custodian of your data. There are no user accounts, your designs are never stored, and your AI API keys are never stored or logged on our servers. This page documents exactly what data moves where, what is retained, and how to report a security issue.

## How your data flows

When you generate code or export variables, the plugin sends the following to our backend (`figma-to-shadcn.vercel.app`, hosted on Vercel):

- A JSON representation of the frame you selected (layout, text content, style values, and design token names)
- Your selected options (AI model, component library, framework, output format)
- Your AI provider API key, used only to authenticate the generation request
- Your license key (if provided) and your Figma user ID, used for license and free-tier checks

Our backend relays the generation request to the AI provider **you** selected — Anthropic, OpenAI, Google, or Vercel v0 — authenticated with **your own API key**. Your designs are processed under your direct relationship with that provider, not through a pooled account.

The plugin makes no other network requests. It does not load third-party fonts, scripts, or analytics, and no tracking services are used.

## What we store — and what we never store

**Never stored:**

- Your design data — processed in memory only, for the duration of the request
- Your AI API keys — forwarded to your chosen provider and discarded; they appear in our logs only as a present/absent flag, never as a value
- Any account or identity data — the plugin has no login and no user accounts

**Stored temporarily:**

- **Generated code files** are saved to private blob storage with unguessable URLs so that the "Copy CLI" and "Open in v0" handoffs work. They are automatically deleted by a daily purge job.

**Stored:**

- A **free-tier usage counter** keyed by your Figma user ID
- On **your own device** (Figma's local plugin storage): your API keys, license key, and plugin preferences. These never leave your machine except as described above and are removed when you clear the plugin's data.

License keys are validated against Polar.sh and appear in our server logs only as a redacted fingerprint (last four characters).

## Who can access stored data

The service is developed and operated by a single developer. Access to the hosting account (Vercel) — and therefore to temporarily stored generated code and usage counters — is limited to the operator. No third party has access to stored data.

## Infrastructure

All infrastructure runs on providers holding SOC 2 Type 2 / ISO 27001 attestations:

- **Vercel** — hosting, serverless functions, blob storage, and KV
- **Anthropic, OpenAI, Google, Vercel v0** — AI processing, under your own API key and the provider's own data policies
- **Polar.sh** — license key validation

We recommend using AI provider API keys with spending limits configured (both Anthropic workspace keys and OpenAI project keys support per-key spend caps) as a general best practice.

## Reporting a vulnerability

If you believe you have found a security vulnerability in the plugin or its backend, please email **[hi@shadcndesign.com](mailto:hi@shadcndesign.com)** with a description of the issue and steps to reproduce. Please do not disclose the issue publicly before we have had a chance to address it.

You will receive an acknowledgement within 72 hours. Confirmed vulnerabilities are prioritized and fixed as quickly as severity warrants, and we will keep you informed of progress. We are grateful for responsible disclosure and will credit reporters who wish to be named.

## Scope of this page

This page covers the Figma to shadcn/ui plugin and its backend service. The shadcndesign.com website, Pro Blocks registry, and Academy have their own respective data practices.