canva-known-pitfalls
Helps developers identify and avoid common pitfalls when integrating with the Canva Connect API, ensuring best practices are followed.
Install this skill
Security score
The canva-known-pitfalls skill was audited on Jun 1, 2026 and we found 15 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 87 | const { job } = await canvaAPI(`/exports/${req.params.jobId}`, token); |
Template literal with variable interpolation in command context
| 115 | const design = await canvaAPI(`/designs/${id}`, token); |
Template literal with variable interpolation in command context
| 120 | const design = await canvaAPI(`/designs/${id}`, token); |
Template literal with variable interpolation in command context
| 121 | cache.set(`design:meta:${id}`, { |
Template literal with variable interpolation in command context
| 189 | await notifyUser(`Edit your design before ${sevenDaysFromNow}: ${design.urls.edit_url}`); |
Fetch to external URL
| 134 | const tokens = await fetch('https://api.canva.com/rest/v1/oauth/token', { |
Webhook reference - potential data exfiltration
| 160 | ## Pitfall #8: Not Validating Webhook Signatures |
Webhook reference - potential data exfiltration
| 163 | // WRONG — accepts any POST as a valid webhook |
Webhook reference - potential data exfiltration
| 164 | app.post('/webhooks/canva', (req, res) => { |
Webhook reference - potential data exfiltration
| 170 | app.post('/webhooks/canva', express.text({ type: '*/*' }), async (req, res) => { |
Webhook reference - potential data exfiltration
| 171 | const payload = await verifyCanvaWebhook(req.body); // JWK verification |
Webhook reference - potential data exfiltration
| 225 | | Unsigned webhooks | Security audit | JWK verification | |
External URL reference
| 134 | const tokens = await fetch('https://api.canva.com/rest/v1/oauth/token', { |
External URL reference
| 231 | - [Canva Authentication](https://www.canva.dev/docs/connect/authentication/) |
External URL reference
| 233 | - [Canva Scopes](https://www.canva.dev/docs/connect/appendix/scopes/) |