# Leaked Figma Token? Delete It and Review Access > Figma personal access token exposed on GitHub? Delete it, create a new one and review file versions and sharing for unexpected changes. Step-by-step guide. Source: https://leakwatch.net/secrets/figma-personal-access-token --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Figma Personal Access Token Code & CI · Secret guide # Leaked Figma Personal Access Token: what to do in the first hour High severityDetected onlyLast verified October 23, 2026 · 4 min read A Figma personal access token lets whoever holds it read the files, comments and projects that its owner can open, through Figma’s REST API. Depending on the token’s scopes, it can also write comments or change other data. Design files often hold unreleased product screens, prototypes and copy, and sometimes mockups with real customer data. Delete the token first, then check what could have been read or changed. [Check your GitHub account for leaked secrets — free](/) Provider Figma Severity High Impact SaaS account access and billing Checked live by LeakWatch No ## What a Figma Personal Access Token looks like This rule does not look for a fixed prefix. It looks for the word `figma` followed, within about 40 characters, by a token-shaped value: six digits, a dash, then four dash-separated groups of lowercase letters and digits. The shape is shown here with the letters masked: ```text NNNNNN-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Figma token shape (masked) ``` Figma’s current token format may differ from this shape, so a leaked token can be missed by the rule. If a file mentions Figma near a long random string, check the value by hand even when no alert appears. ## How Figma Personal Access Tokens get leaked - **Design-token and export scripts.** A script that pulls colors, icons or tokens from Figma into a codebase, with the token written into the script. - **Plugin and integration code.** A plugin or a sync job that keeps a token in its source or in a committed configuration file. - **Environment files.** A `.env` file with a Figma variable committed with the rest of the project. - **Shared documentation.** A setup guide or example request with a working token left in the snippet. - **CI logs.** A pipeline step that prints the request headers while debugging an export. ## What to do in the first hour 1. **Create a replacement token first.** Open your Figma account settings, find the security section that lists personal access tokens, and create a new one. Choose the narrowest scopes the job needs, and set an expiry date if the form offers one. 2. **Update the tools that use it.** Put the new token into your export script, plugin or CI secret store, then run it once to confirm it works. 3. **Delete the exposed token** from the same section. Requests with the old token fail from then on. 4. **Review file version history.** Check the version history of the files the token’s owner can open, for the period since the exposure. Look for edits and comments you did not make, and for files that were duplicated or moved. 5. **Check sharing and libraries.** Review the link-sharing settings of your projects and files, and any shared component libraries you publish. Remove access that nobody needs. 6. **Check team membership.** Review who is on the team and project that the token’s owner can reach, and remove anyone who should not be there. 7. **Assume unreleased designs were seen.** If the affected files show unreleased features, handle them under your incident process. Clean the repository too: remove the value from the file and rewrite history if needed. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) and [deep scan your whole git history](/blog/deep-scan-your-whole-git-history). Not sure what else leaked? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at Figma Personal access tokens are listed in the security section of your Figma account settings. Find the token by its name, then delete it. Deleting it ends its access immediately. If a shared integration used a token that belongs to a former employee, create the replacement under an account that will stay in the team, and move the integration to it. ## How LeakWatch detects it The rule is called “Figma Personal Access Token”. It looks for the word `figma`, matched without regard to letter case, followed within about 40 characters by a token-shaped value: six digits, a dash, then four groups of lowercase letters and digits separated by dashes, with word boundaries at both ends. The severity is **high**. This type is not checked live: LeakWatch does not send any request to Figma with the token it found. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Can a Figma token read private files? Yes, for any file the token’s owner can open. Private projects and team files are included, so the token can see more than a public link does. Is deleting the token enough? It stops future access, but it does not show what was already read or changed. Check the version history and the sharing settings after you revoke. Our design team shares one account. What now? A shared account makes it hard to tell who did what. Revoke the token, create a personal token for each person or integration that needs one, and keep the shared account for nothing but its own tasks. ## Related - [Notion API Token](/secrets/notion-api-token) - [Airtable Personal Access Token](/secrets/airtable-personal-access-token) - [GitHub Personal Access Token](/secrets/github-personal-access-token) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Figma. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)