Opening the security report for api.prod.ml-plat.figma.engineering
api.prod.ml-plat.figma.engineering
Loading the security report for api.prod.ml-plat.figma.engineering
api.prod.ml-plat.figma.engineering
Is api.prod.ml-plat.figma.engineering Safe? Security Score 86.5/100 | CyStack
api.prod.ml-plat.figma.engineering
Industry
–
Origin
–
Global rank
–
Rank in
–
Updated at
B86.5/100
Security level
Good
Data confidence
High
Scope checked
98.5%
The higher the score, the more externally observable protections the system has recorded. This page does not certify that the website is reputable, legitimate, or completely free of vulnerabilities.
Is the website “api.prod.ml-plat.figma.engineering” safe?
As of October 30, 2026 at 09:15, api.prod.ml-plat.figma.engineering has a security score of 86.5/100 (grade B: “Good”). CyStack’s automated assessment recorded 9 issues to review after completing 98.5% of applicable checks. The website owner should address “DMARC blocking policy” first, then review the remaining items in order of impact.
Does api.prod.ml-plat.figma.engineering show known scam, phishing, or malware signals?
At assessment time, CyStack did not find api.prod.ml-plat.figma.engineering or related infrastructure on any scam, phishing, or malware warning list after checking 5 online reputation sources. This result reflects external observations; it does not guarantee absolute safety or verify the organization’s legal status or reputation.
Potentially exposed domain email addressesChecks infostealer data for email addresses ending in @figma.engineering, the registered domain of the assessed website api.prod.ml-plat.figma.engineering. A record is not counted merely because someone visited or signed in to the website.0 matching email exposure records
0Matching email exposure records
0Related infected devices (estimated)
No exposure record was found for an email address ending in @figma.engineering in the available data. This does not guarantee that an exposure has never occurred.
Frequently asked questions
What affects the security of api.prod.ml-plat.figma.engineering?
A valid SSL certificate still does not prove that api.prod.ml-plat.figma.engineering is safe, legitimate, or free of scam signals. For a more complete assessment, this report also checks phishing and malware, exposed email records, IPs and open ports, subdomains, technologies, and CVEs that may apply to observed versions.
Does api.prod.ml-plat.figma.engineering use HTTPS, and is its SSL certificate valid?
api.prod.ml-plat.figma.engineering used a valid SSL certificate at assessment time, valid until May 6, 2027. This status may change when the certificate expires or the server configuration changes.
Data compiled from CyStack cybersecurity monitoring systems
CyStack compiles scan results from its internal cybersecurity monitoring systems, including CyStack VulnScan and CyStack Threat Intelligence, together with publicly available Internet data. The assessment only observes and analyzes information already available; it does not attempt unauthorized access, test passwords, send exploit code, or change or disrupt the assessed system.
These 3 failed checks or warnings have the greatest impact on the result for api.prod.ml-plat.figma.engineering.
DMARC blocking policyThe effective DMARC policy is quarantine and applies to 100% of messages.High
Why it matters
A policy of quarantine or reject tells receiving services to move suspicious mail to spam or refuse it. A monitoring-only policy (p=none) records the problem but does not ask receivers to stop spoofed mail.
What to do
After every legitimate sender passes DMARC, move gradually to quarantine and then reject, covering 100% of messages.
Correct file-type handling (nosniff)The inspected root response does not set X-Content-Type-Options to nosniff.Medium
Why it matters
Without the nosniff setting, a browser may guess a file's type and treat harmless-looking content as executable code. This can turn an incorrect Content-Type into a security issue.
What to do
Send X-Content-Type-Options: nosniff on every response and return an accurate Content-Type.
HSTS availabilityThe HTTPS response does not contain an effective HSTS policy.Medium
Why it matters
HTTP Strict Transport Security (HSTS) tells a browser to use HTTPS automatically on future visits. This reduces the chance that a visitor is downgraded to an unencrypted connection.
What to do
After confirming that every required page works over HTTPS, send the Strict-Transport-Security header on all HTTPS responses.
Data provided by
Discovered subdomains (224)Subdomains of figma.engineering, the registered domain of the assessed website api.prod.ml-plat.figma.engineering. Sensitive-looking names are shown first; individual subdomains have not been separately security-tested.Complete
admin.devbox.figma.engineeringSensitive-lookingAdmin system
admin.devenv01.figma.engineeringSensitive-lookingAdmin system
admin.figma.engineeringSensitive-lookingAdmin system
admin.local.figma.engineeringSensitive-lookingAdmin systemInternal system
Public web contextThe website title, description, industry and popularity.
Page title
–
Website category
–
Description
–
Global rank
–
Rank in
–
Rank in industry
–
Final URL
https://api.prod.ml-plat.figma.engineering/
This is a quick, point-in-time check from outside the organization. It can surface visible risks, but it does not replace penetration testing or an authenticated assessment.
Have @figma.engineering email addresses appeared in exposed data or information-stealer (infostealer) logs?
No record associated with an @figma.engineering email address was found in the currently available data. This does not rule out incidents that have not been observed.
Which public IPs, services, and ports does api.prod.ml-plat.figma.engineering expose?
The assessment observed 2 public IPs and 2 open ports for api.prod.ml-plat.figma.engineering; the infrastructure appears to be operated by Amazon Technologies Inc.. An open port is not automatically a vulnerability, but every public service should be updated and appropriately restricted.
How many subdomains of figma.engineering have been discovered?
The assessment observed 224 public subdomains of figma.engineering. This list can reveal additional entry points such as APIs, administration systems, or test environments, but it does not mean that every subdomain is risky.
Industry
Updated at 
