Security built around connected workspaces.

• COSMO accounts use authenticated sessions managed through the application backend.
• COSMO Connect uses device-bound plugin tokens associated with a user and workspace.
• Plugin sessions can be revoked from the account interface and are invalidated when access is removed.
• Workspace switching and membership checks are enforced server-side before privileged actions.

• OAuth credentials for connected services are stored server-side rather than in Figma documents or client-side settings.
• Integration credentials use authenticated encryption with managed key identifiers in the server environment.
• OAuth state and PKCE flows are used to reduce replay and authorization-code interception risks.
• Provider scopes are limited to the permissions required by the active integration.

• Supabase Row Level Security and explicit workspace membership checks restrict customer data access.
• Stripe webhook signatures are validated before subscription state changes are accepted.
• Export limits are enforced on the server so plan controls cannot be bypassed by editing the plugin UI.
• CI runs linting, type checking, automated tests, production builds and dependency audit checks before merges.

Security reports should be submitted through the COSMO contact channel with the category Security. Please avoid including live credentials, passwords or unnecessary personal data.

Report a security issue →

COSMO does not currently present itself as SOC 2 certified, ISO 27001 certified, PCI certified, or independently penetration-tested unless and until the relevant assessment is completed. Payment card processing, when enabled, is delegated to Stripe rather than handled directly by COSMO.