01

Security

Your design system, under lock

Basemode holds keys to your Figma files and your repository. Here is every control that keeps them, and your team's accounts, safe. Nothing on this page is a promise about the future: it's how the product works today.

Report a security issue
Inspection · BM-SEC
  • Your credentials5 controls
  • Signing in5 controls
  • Sessions4 controls
  • Requests4 controls
  • Accountability3 controls
  • Infrastructure5 controls
Controls
26
Areas
6
Region
us-east1
In place
01

Your credentials

What you connect stays sealed.
  • Figma, GitHub and Slack credentials are encrypted at rest and never returned by the API
  • Anyone with access sees what's connected, not the secret itself
  • A design system's key is stored as a hash and shown once
  • That key opens only token ingest and the Figma webhook, nothing else
  • Agents connect with a read-only developer key per design system
02

Signing in

Accounts are hard to take over.
  • Two-factor sign-in with an authenticator app, and recovery codes
  • SAML single sign-on through your identity provider
  • Logins, sign-ups, resets and two-factor codes are rate-limited per browser, even behind proxies
  • Verified email addresses, one account per address whatever its case
  • A security email whenever how someone signs in changes
03

Sessions

Short-lived, and yours to end.
  • Sessions and invitation links are stored as hashes
  • Sessions extend while you're active and are capped at 30 days
  • See every signed-in device and sign any of them out
  • Expired sessions and invitations are removed twice a day
04

Requests

The browser is locked down.
  • Cross-site requests are refused
  • A Content-Security-Policy on every page, with no framing by other sites
  • Oversized requests are refused
  • A production server refuses to start on unsafe settings
05

Accountability

Every action leaves a record.
  • An audit log of every action, searchable by person and kind of event
  • Built-in and custom roles, with access checked per permission
  • An organization is never left without an owner
06

Infrastructure

Released the careful way.
  • Runs on Google Cloud Run with Postgres, in us-east1
  • Secrets live in Google Secret Manager and are mounted at runtime
  • Deploys sign in through workload identity, with no long-lived keys
  • Every release action is pinned to a commit
  • Each change is scanned for secrets, vulnerable dependencies and container misconfiguration
Sign-off

Give your design system some teeth

Try it with sample tokens in a couple of minutes, then connect Figma, GitHub and your agents when you're ready. No card needed.

Prefer email? hello@basemode.io