Technical Documentation
Excalidraw Risk Register
Excalidraw Risk Register
| ID | Risk | Likelihood | Impact | Mitigation | Owner |
|---|---|---|---|---|---|
| R-01 | Upstream releases a breaking change to the <Excalidraw /> prop API | Medium | Medium | Pin exact version; review CHANGELOG on upgrade; Playwright regression suite. | Web platform |
| R-02 | Malicious .excalidrawlib uploaded by user contains script SVG | Medium | High | svg-sanitizer.ts strips scripts, event handlers, javascript: URLs; file-type and magic-byte validation. | Security |
| R-03 | Scene JSON contains BYOK API key text pasted by user | Medium | High | Scene redaction on save and export; on-save warning banner if a secret pattern is detected. | Security |
| R-04 | Excalidraw internal API changes break Rafa proposed-change apply | Medium | Medium | Rafa only speaks the public serialization envelope; wrapper isolates Excalidraw imperative API. | AI |
| R-05 | Plan bypass via direct POST /rest/v1/diagrams | Low | High | Server trigger and RLS enforce plan caps; entitlement checks on every RPC. | Backend |
| R-06 | Bundle size regressions leak Excalidraw into marketing pages | Medium | Medium | CI bundle-size budget; verify Whiteboard chunk is dynamic-only. | Web platform |
| R-07 | Large scene DoS via 100k elements | Low | Medium | Server-side element cap; client warns above 4k; refuses save above cap. | Backend |
| R-08 | Cross-user scene access via forged diagram_id | Low | High | RLS owner_id = auth.uid(); shared diagrams gated by diagram_shares policies. | Backend |
| R-09 | Excalidraw font licensing changes | Low | Low | Fonts remain inside the upstream package; not redistributed. | Legal |
| R-10 | Rafa applies destructive proposal without checkpoint | Low | High | Wrapper snapshots version before apply; UI requires explicit confirm on delete/replace. | AI |