Content Reel

Review summary

First-party Microsoft plugin, 1.1M+ users. All 5 functions (Home, Text, Image, Icon, Add) were exercised live and work as documented — content applies to a selected layer with a single click. Runs inside a Figma-enforced network allowlist. Live testing confirmed one telemetry endpoint firing; the rest of the allowlist is taken from the manifest and Figma's own permission badge, not from captured traffic. Biggest risk isn't the network calls — it's that anything you upload through "Add" is shared Public by default.

Privacy overview

What this plugin can access and where data may go. “Unknown” means we have not verified it — not that it is safe or unsafe.

Data accessed

• Layers you select to receive pulled content
• Text and up to 20 images you choose to upload via "Add"
• A reference image, if you use the Icon tab's "Icon Visual Search" (search icons by picture instead of text) — an undocumented feature found during testing

Permissions requested

• Restricted network access (Figma-enforced allowlist, confirmed on the listing page)

External services

• contentreel.design (Microsoft's own API + websocket)
• Azure App Service — icon delivery
• Azure-hosted CORS proxy
• Azure Blob Storage — image uploads

External APIs

• None observed beyond Microsoft's own service

Database connections

Independent Review

Authentication

Optional Google or Microsoft sign-in. Verified by testing: browsing Favorites/public content, and applying text/image/icon content, all work signed out; both "Add" (upload content) and "My content" (personal library) show a "Sign in with your Google or organization's account" gate.

Cloud storage

• Uploaded images stored in an Azure Blob bucket named "assetbucketdevelopment"

Analytics

• Verified — Azure Application Insights beacon captured firing during use

AI providers

• None observed

Telemetry

Same Application Insights channel; disclosed in Microsoft's license terms

Cookies

Independent Review

Risk assessment

Risk level

Medium risk

Why this risk exists

Content you create is set to Public by default in the shared library, and Microsoft's terms grant Microsoft and Figma a broad license to use anything you share.

Mitigation

Set custom content to Private before uploading anything sensitive or brand-confidential.

Confidence

Medium

Review methodology

Tests performed

• Community listing + permission badge inspection
• Terms of Use and privacy language review
• Live install in a disposable Figma file
• Functional test of all 5 tabs: Home, Text, Image, Icon, Add
• Network capture during load, browse, apply, and icon-load

Evidence

• Figma community page (read)
• contentreel.design/terms (read)
• Live network capture: dc.services.visualstudio.com/v2/track (204, confirmed twice)
• Applied Lorem Ipsum text to a text layer — replaced content instantly, one click
• Applied an avatar image to a rectangle fill — replaced content instantly, one click
• Applied a Fluent icon to the canvas — added new Frame + Vector layer, one click
• Opened "Add" and "My content" — both correctly gate behind a sign-in prompt (not completed, per policy against entering credentials on the user's behalf)
• Discovered "Icon Visual Search" (search icons by picture) — not mentioned on the community listing page

Known limitations

• Plugin UI runs in a sandboxed iframe the network monitor can't fully see into — only 1 of 8 declared domains was confirmed on the wire
• Manifest.json not pulled directly
• domain list is user-supplied, corroborated only by Figma's badge
• Sign-in not completed (no credentials entered on user's behalf)

Reviewer

AI Agent supervised by a human

Read more about how we review and what Verified, Observed, Inferred and Unknown mean.

Review timeline

1. 2026-07-10Initial review published

Resources

• Official website
• Terms of service