Figma 如何借助智能体在漏洞防范中保持领先
How Figma stays ahead of vulnerabilities with agents
Figma 如何利用代理防范漏洞于未然
Rohan SharmaSecurity Engineer, Figma
Rohan Sharma，Figma 安全工程师
Liam BuchanSecurity Engineer, Figma
Liam Buchan安全工程师，Figma
Dave MartinSecurity Engineer, Figma
Dave Martin，安全工程师，Figma
Precision is the share of reported findings that are real vulnerabilities. High precision implies low false positives.
Precision 是报告的发现中属于真实漏洞的比例。高 Precision 意味着低误报率。
Recall is the share of real vulnerabilities the system catches. High recall implies low false negatives.
Recall 是系统捕获的真实漏洞的比例。高 Recall 意味着低漏报率。
Pointing coding agents at the codebase and asking them to find vulnerabilities is simple. Getting the precision and recall an organization needs is still hard engineering: How many findings are legitimate, and how many actual bugs does the system catch?
让编码代理指向代码库并要求它们寻找漏洞很简单。但要获得组织所需的精确度和召回率仍然是困难的工程问题：有多少发现是合理的，系统又捕获了多少实际漏洞？
This post walks through how we approach precision, recall, and trust when it comes to running agentic security for Figma’s codebase. We use agents to prevent, detect, and fix vulnerabilities at three stages: code generation, pull request review, and auditing of historical code.
本文介绍了我们在为 Figma 的代码库运行代理安全时如何处理精确度、召回率和信任问题。我们使用代理在三个阶段预防、检测和修复漏洞：代码生成、pull request 审查以及历史代码审计。
We’ll share learnings across these stages, spending most of our time on PR review—the first thing we built, which unlocked secure code generation and auditing by helping us develop and automatically improve the policy all of our security agents follow.
我们将分享在这些阶段学到的经验，把大部分时间花在PR审查上——这是我们构建的第一项功能，它通过帮助我们开发并自动改进所有安全代理遵循的策略，解锁了安全的代码生成和审计。
Generation, review, and auditing all apply the same shared policy that contains trust boundaries, accepted risks, and precedents.
生成、审查和审计都应用相同的共享策略，其中包含信任边界、可接受的风险和先例。
Secure code review
安全代码审查
We built review first because its improvement loop is faster than those for generation or auditing. Three properties make that loop work:
我们首先构建了 review，因为它的改进循环比生成或审计的循环更快。有三个特性使该循环得以运转：
- It's universal: Every pull request goes through it.
- 它是通用的：每个拉取...