Agent skill · security · jeremylongshore
canva-security-basics
Implement the Canva Connect security baseline for backend OAuth, least privilege, tenant isolation, logging, revocation, and preview webhook verification. Use when threat-modeling, reviewing, or hardening an integration. Trigger with: "secure Canva integration", "Canva token security", "verify Canva webhook".
Why this skill is useful
Provides specific security practices and code snippets for securing Canva API integrations that the AI wouldn't reliably generate on its own.
What it needs
Requires canva account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Canva Integration Security Baseline Overview Protect client secrets and user tokens as separate high-impact credentials. Enforce authorization before provider access and treat preview webhook verification as an additional boundary, not proof of business authorization. Prerequisites Integration ID, environments, operations, tenants, and threat scope Current scopes, redirect URIs, token stores, and data flows Webhook/preview use, incident response, secret scanning, and audit controls Instructions Step 1: Inventory secrets and flows Use Read and Grep to locate client secrets, access/refresh tokens, PKCE verifier, OAuth state, callbacks, browser bundles, logs, backups, jobs, and external processors. Step 2: Harden OAuth Require controlled redirect hosts, one-time state/verifier, backend token exchange, encrypted and separated tokens, per-user refresh serialization, revocation, and disconnect cleanup. Step 3: Minimize authorization Request explicit minimum scopes and enforce tenant, resource, role, capability, purpose, and preview status server-side before every action. Step 4: Harden data and logs Use Write or Edit to prevent tokens, bodies, signed URLs, personal data, and resource identifiers from routine logs; protect stored content and deletion workflows. Step 5: Verify webhooks For authorized preview use, validate the signed token/claims against cached Canva JWKs, select by case-sensitive key ID, refetch only for unknown keys, enforce replay/idempotency controls, and authorize resulting actions separately. Step 6: Harden dependencies and deployment Pin provider/client inputs, scan secrets, isolate environments, protect CI from forks, deploy immutably, and maintain tested rollback and credential rotation. Step 7: Prove controls Test state mismatch, token leak prevention, cross-tenant denial, refresh races, scope denial, unknown webhook key, replay, revoked consent, and account deletion. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/canva-security-basics