Pixels

Review summary

Live traffic tested across both plugin features (Apply and Vectorize), run on a real image in a disposable Figma file. No requests to any developer-owned domain were observed in any test.

Privacy overview

What this plugin can access and where data may go. “Unknown” means we have not verified it — not that it is safe or unsafe.

Data accessed

• Selected shape's image fill
• No access observed to other pages, files, or account data

Permissions requested

• Current page read/write
• Selection access

External services

• None observed (developer domain)

External APIs

• None observed

Database connections

Unknown — not yet reviewed

Authentication

None

Cloud storage

• None observed — output is written directly into the Figma file

Analytics

• Datadog and Statsig calls observed, but attributed to Figma's own app, not the plugin

AI providers

• None observed

Telemetry

Unknown — not yet reviewed

Cookies

Unknown — not yet reviewed

Risk assessment

Risk level

Low risk

Why this risk exists

Tested live on a real image through both "Apply" and "Vectorize." Every request stayed on figma.com; nothing went to the developer's domain.

Mitigation

Safe to use as-is. Plugin is unmaintained since 2022, so don't expect fixes if Figma's API changes.

Confidence

High

Review methodology

Tests performed

• Manifest/network-access badge inspection
• Live traffic capture (4 runs: cold load, Apply/no selection, Apply/real image, Vectorize/real image)
• Manual usage on a disposable test file

Evidence

• Community page (read)
• Live network capture, 2026-07-09 (recorded)

Known limitations

• Source code not available for audit
• Single session, single plugin version tested

Reviewer

AI Agent

Read more about how we review and what Verified, Observed, Inferred and Unknown mean.

Review timeline

1. 2026-07-09Initial review published

Resources

• Official website