canva-security-basics
Implements security best practices for Canva Connect API OAuth tokens, ensuring secure access and integration.
Install this skill
Security score
The canva-security-basics skill was audited on May 19, 2026 and we found 27 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 77 | const basicAuth = Buffer.from(`${clientId}:${clientSecret}`).toString('base64'); |
Template literal with variable interpolation in command context
| 82 | 'Authorization': `Basic ${basicAuth}`, |
Fetch to external URL
| 79 | await fetch('https://api.canva.com/rest/v1/oauth/revoke', { |
Webhook reference - potential data exfiltration
| 29 | Security best practices for Canva Connect API OAuth 2.0 tokens, client credentials, and webhook verification. The Canva API uses OAuth with PKCE — there are no static API keys. |
Webhook reference - potential data exfiltration
| 103 | // Full collaboration — includes comments and webhooks |
Webhook reference - potential data exfiltration
| 112 | ## Webhook Signature Verification |
Webhook reference - potential data exfiltration
| 114 | Canva signs webhook payloads with JWK. Verify before processing. |
Webhook reference - potential data exfiltration
| 119 | // Fetch Canva's public keys for webhook verification |
Webhook reference - potential data exfiltration
| 125 | async function verifyCanvaWebhook( |
Webhook reference - potential data exfiltration
| 126 | token: string, // JWT from Canva webhook |
Webhook reference - potential data exfiltration
| 139 | app.post('/webhooks/canva', express.text({ type: '*/*' }), async (req, res) => { |
Webhook reference - potential data exfiltration
| 140 | const result = await verifyCanvaWebhook(req.body); |
Webhook reference - potential data exfiltration
| 143 | await handleWebhookEvent(result.payload); |
Webhook reference - potential data exfiltration
| 156 | - [ ] Webhook signatures verified with JWK |
Webhook reference - potential data exfiltration
| 168 | | Unsigned webhook | Missing verification | Always verify JWK signature | |
Webhook reference - potential data exfiltration
| 175 | - [Webhook Keys API](https://www.canva.dev/docs/connect/api-reference/webhooks/keys/) |
Access to .env file
| 36 | # .env (NEVER commit) |
Access to .env file
| 41 | .env |
Access to .env file
| 42 | .env.local |
Access to .env file
| 43 | .env.*.local |
Access to .env file
| 151 | - [ ] `.env` files in `.gitignore` |
External URL reference
| 79 | await fetch('https://api.canva.com/rest/v1/oauth/revoke', { |
External URL reference
| 120 | // GET https://api.canva.com/rest/v1/connect/keys |
External URL reference
| 122 | new URL('https://api.canva.com/rest/v1/connect/keys') |
External URL reference
| 173 | - [Canva Authentication](https://www.canva.dev/docs/connect/authentication/) |
External URL reference
| 174 | - [Canva Scopes](https://www.canva.dev/docs/connect/appendix/scopes/) |
External URL reference
| 175 | - [Webhook Keys API](https://www.canva.dev/docs/connect/api-reference/webhooks/keys/) |