Excalidraw Test Plan

Unit / component

• src/lib/security/svg-sanitizer.test.ts — strips <script>, event handlers, javascript: URLs, foreign content, external entity references.
• src/lib/excalidraw/serialize.test.ts — round-trips a scene through serializeScene → restore without data loss.
• src/lib/security/scene-redaction.test.ts — redacts BYOK key patterns (sk-…, AKIA…, JWTs, Supabase service-role prefixes) in text elements.

Playwright E2E (tests/e2e/)

• whiteboards.spec.ts — Free user hits UpgradeWall; Pro user can create, rename, delete a whiteboard.
• whiteboard-export.spec.ts — PNG and SVG export produce non-empty files.
• whiteboard-checkpoint.spec.ts — checkpoint create + list.
• whiteboard-share.spec.ts — shared link with role gating and passcode.

RLS tests

• Non-owner cannot SELECT, UPDATE, or DELETE another user's diagram where kind = 'excalidraw'.
• Anonymous cannot read public.diagrams.
• Free user cannot insert more than three active diagrams.

Fuzz / security

• Upload 20 hand-crafted malicious .svg and .excalidrawlib samples; assert all are neutralized or rejected.
• Attempt to inject <script> via text element; assert exports contain no executable content.

Performance regression

• Load a synthetic 5,000-element scene; assert paint time under 2 s and autosave payload under 500 KB.