Canva Integration Hazard Review

Overview

Turn common failure patterns into evidence-backed findings rather than universal rules. Reconfirm time-sensitive provider behavior against current first-party contracts before enforcing it.

Prerequisites

• Repository scope, deployment/config version, and operation inventory
• Pinned OpenAPI, current docs, granted scopes, and preview surfaces
• Data policy, operation ledger, and redacted incident evidence

Instructions

Step 1: Review OAuth

Use Read and Grep to find browser-side secrets, missing state/PKCE validation, broad or implied scopes, refresh races, token logging, and incomplete disconnect cleanup.

Step 2: Review authorization