I gotta say, the Figma team's blog has been on fire with quality posts about their sandbox. They've posted all details about their sandbox implementation, then

I gotta say, the Figma team's blog has been on fire with quality posts about their sandbox. They've posted all details about their sandbox implementation, then all the details about this dependency vulnerability that they were on top of, they showed how they reviewed logs for exploitation traces to find there was none, and finally described their strategy for future proactive protection. Kudos all around!