Penpot deployment and security realities

Penpot provides a viable alternative for teams that require data sovereignty through self-hosting. The platform uses open web standards like SVG, HTML, and CSS to bridge the gap between designers and developers. Companies in regulated sectors like healthcare and finance use Penpot because they can deploy it in air-gapped environments or on their own infrastructure. This control allows them to maintain full responsibility for data residency and compliance with laws like GDPR.

The software remains free to use because the company has not implemented paid features. This model attracts teams looking to avoid the per-seat pricing of proprietary tools. You might find the lack of a traditional business model a risk for long-term stability, but Penpot recently raised $12 million to support its 250,000 users. The company uses ClojureScript to target the DOM, which helps designers export CSS-ready properties directly.

A critical security vulnerability, CVE-2026-26202, appeared in February 2026. This path traversal flaw affects Penpot versions prior to 2.13.2. An authenticated user with team edit permissions can exploit the create-font-variantRPC endpoint to read arbitrary files from the server filesystem. This flaw allows attackers to exfiltrate sensitive system files, application secrets, or database credentials by supplying a local file path as a font data chunk. Organizations must upgrade to version 2.13.2 or later to mitigate this risk.

Performance hurdles and feature gaps

Performance remains the primary reason teams hesitate to switch from Figma. Penpot rendering logic relies on the browser’s ability to handle large numbers of DOM elements. Users report that files render very slowly when they contain complex components. One tester noted that zooming in and out on the canvas displays only placeholder images when the page has few components.

Collaboration in Penpot lacks the real-time immediacy found in Figma. When multiple people work in the same file, updates do not always reflect in real time. For example, a change to a sticky note might not appear until the user leaves that note. The tool also lacks certain features like advanced variable handling in components or a native whiteboard tool.

Users also face difficulties when trying to migrate existing workflows. Penpot cannot natively parse proprietary .xd or .fig files. You must export assets as SVGs and rebuild component libraries manually. Because Penpot uses CSS standards for layout instead of proprietary constraint models, you must reset layout properties to make them work correctly.

Infrastructure and workflow integration

Penpot integrates with enterprise authentication systems using OIDC, LDAP, or SAML SSO. This reduces identity fragmentation because teams can tie design access to their existing DevOps stack. Because the platform uses open formats, developers can store design artifacts alongside code in existing repositories.

The platform works well for engineering-forward teams that want to avoid vendor lock-in. Unlike Figma, which uses C++ and WebAssembly to render to an HTML Canvas, Penpot uses the browser’s native rendering. This makes the design-to-code handoff easier for web-delivered products.

The tool provides a way to manage design tokens using the W3C DTCG spec. You can import and export these tokens as JSON without using third-party plugins. This functionality helps teams maintain design systems without paying for premium enterprise tiers. Can Penpot maintain its rapid feature release cycle while scaling its user base to millions? Engineering teams should evaluate if they have the DevOps resources to manage a self-hosted instance.