Loading today’s stories
Build1 distinct publisher2 min readPublished
One developer's account of shipping the same publish feature into three desktop editors suggests the cost of plugin work sits in sandbox rules, not in the feature.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
The 120 lines are the honest part of the accounting [3]. The publishing API already existed, which is why the author expected the Figma side to be small [5], and the plugin logic duly was.
What surrounds it is a five-step sequence that exists only because the API will not take a large image inside a JSON body: create the post, get an upload URL, PUT the PNG, complete the media, update the post [12]. A post with no image is a single call [11]. So attaching one frame costs four extra round trips [1], and the post has to sit as a draft until the media arrives, which is the thing that stops a scheduled post going out with no picture [13].
The export is doubled as well. A small copy for the preview, and a separate 2x export for publishing, because social networks recompress uploads and small text on a design goes soft by the time it reaches a feed [18][19]. Reasonable engineering, and none of it feature work.
Count the places this one feature has to run and it comes to three: Figma's document thread, the plugin's UI iframe, and a Cloudflare Worker sitting in front of the API [2]. The worker holds no credentials of its own; the key lives in figma.clientStorage and is passed through on each request [14]. That means the relay is not a security boundary anybody wanted. It is a header-rewriting box that exists because a sandboxed iframe announces itself as Origin: null and the API had no reason to accept that [10].
The author's own framing of the trap is the useful part: these details leave no trace when you picture the feature in your head as "export the frame and send it to the API" [9]. That is the estimate failure. Nothing on the list is hard, and nothing on the list is visible from the spec, which read as: select a frame, write a caption, pick accounts, publish, without exporting the image and opening a second app [4].
One caveat on how far this generalises. The piece is titled on three editors and says the same guest-in-someone-else's-house problem showed up in each [1], but the itemised bill is Figma's, and Figma is described as the strictest of the three [2]. The Obsidian and VS Code numbers are not in the account. What the evidence supports is narrower and still useful: on the most locked-down host, the sandbox rules generated more deployable surface than the feature did, and a plugin estimate that prices features rather than permissions will be wrong in the same direction every time.
Ranked by verification strength, evidence, and original report placement.
The author built integrations back to back for three desktop apps where people work with text and images: Obsidian, VS Code and Figma, and describes the common experience as being a guest in someone else's house.
The author states Figma was the strictest host of the three, locked down tighter than Obsidian or VS Code, and tells the story through Figma because everything shows up there at once.
The main Figma plugin file is 120 lines; the author says the work was not in those lines but around them.
The task was: select a frame, write a caption, pick your social accounts, publish, without exporting the image and opening a second app.
The publishing API already existed, so the author expected the Figma side of the work to be small.
Figma hands the plugin raw PNG bytes rather than a file: exportAsync() returns a Uint8Array.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Specific and code-backed, but single-source and self-reported
The technical claims are unusually concrete for a single-source story: inline code shows the exportAsync() constraint object, the Array.from/postMessage/Uint8Array round trip, and the Math.min caption-limit function, and the five-step publish chain is spelled out step by step. That specificity makes the account internally coherent and checkable in principle. But the entire cluster is one first-person post by the implementer, with no vendor documentation, second report, or artifact corroborating either the Figma platform behaviours or the described architecture, and the source text is truncated mid-sentence in the manifest section. Score reflects high claim specificity discounted for zero independent corroboration.
One vendor's own integrations, no usage data
Adoption evidence exists but is entirely first-party and unquantified: a Figma plugin built and prepared for Community listing, a Canva integration under marketplace review, and asserted Obsidian and VS Code integrations. There are no install counts, active-user figures, review outcomes, or third-party deployments, and no indication anyone outside the author's team has adopted the described sandbox-and-proxy pattern. Low score reflects real but singular, self-reported deployment.
Modest claims, mild n=1 generalisation
The article itself is deliberately unshowy — 'nothing impressive in that code' — and its technical claims stay narrow and specific, which keeps overstatement low. The gap that does exist is in framing rather than substance: the title and dek generalise a pattern across three editors and toward plugin work broadly, while only Figma is actually documented, and the sweeping 'you're a guest in someone else's house' thesis rests on a single implementer's experience with one product's API. Slightly positive, not seriously inflated.
Vendor engineer writing about own product
The author is building integrations for Publora, which is named throughout as the API the plugin talks to, and the piece doubles as visibility for a plugin awaiting marketplace listing on a developer-community platform with no editorial gatekeeping. That is a clear promotional incentive. It is mitigated by disclosure being explicit rather than hidden, by the content being unflattering in places — extra proxy infrastructure, duplicated workers, boring per-platform edge cases — and by the absence of pricing or competitive claims. Moderate-to-high, transparently held.
Confident on mechanics, weak on generalisation
Confidence is high for the specific Figma implementation details, which are code-backed, mutually consistent, and describe well-defined platform mechanics. It falls sharply for the broader thesis about plugin development across hosts, for anything about adoption or impact, and for the truncated listing-requirements material. The single-source, vendor-authored basis caps the overall figure near the midpoint.
invest
Databricks raises $5B at $190B, and the multiple barely moved2 distinct publishers
product
Canva's $7.1bn markdown is an inference bill, not a mood swing1 distinct publisher
invest
Klaviyo made agent fluency a condition of employment for 2,300 people1 distinct publisher
build
A build step instead of a backend: 1,025 records, 8 locales, no runtime API1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 25, 2026