Security fixes are provided for the latest 0.1.x release and the default branch.

Use GitHub private vulnerability reporting. Do not open a public issue for an unpatched vulnerability. Describe affected versions, impact, reproduction, and suggested mitigation. Do not include real Figma documents, access tokens, account data, or unrelated personal content.

• The bridge listens only on 127.0.0.1:3846.
• No Figma access token is requested or stored.
• Document changes execute in the visible Figma Desktop plugin sandbox.
• Reads and writes are bounded; writes can carry a planned context snapshot.
• Deletion, remote commands, and arbitrary JavaScript execution are not exposed.
• Automatic updates accept only the official Layntra GitHub origin and only fast-forward a clean, non-diverged checkout. Git operations are non-interactive and time-bounded; failures preserve and start the installed version.

Processes running as the same operating-system user may reach loopback ports. Do not run untrusted local software while a sensitive Figma file and Layntra companion are open. Codex model data handling is governed by the user's Codex configuration and is outside Layntra's local bridge boundary.