If you discover a security vulnerability in fgm, please report it responsibly:

1. Do NOT open a public issue
2. Use GitHub's private vulnerability reporting
3. Include: description, steps to reproduce, potential impact

• Acknowledgment: within 48 hours
• Initial assessment: within 1 week
• Fix timeline: depends on severity

When using fgm:

• Never commit your Figma token to version control
• Use fgm auth login to store tokens securely in your system keychain
• If using environment variables, set FIGMA_TOKEN in your shell session, not in committed config files
• The .gitignore includes patterns to prevent accidental credential commits
• git-secrets hooks are configured to catch common token patterns
• Run ASP preflight before commit: ./scripts/utilities/asp-preflight.sh --staged --strict
• Install ASP + git-secrets pre-commit checks: ./scripts/automation/install-asp-hooks.sh . --force
• Follow repository ASP policy: docs/security/ai-safety-policy.md