Collaborative Whiteboard Security Testing

Excalidraw Security Testing: Default Credentials, API Key, Database, and Collaborative Whiteboard

📅 July 3, 2026 ⏱ 10 min read 🏷 Excalidraw, Collaborative Whiteboard Security, Room ID Enumeration, Redis, Firebase API Key, WebSocket, Room Data, Self-Hosted Security

Excalidraw is widely deployed as a self-hosted collaborative whiteboard — organizations use it for architecture diagrams, incident response war rooms, and brainstorming sessions containing sensitive information. Key assessment areas: collaboration room IDs are guessable enabling unauthorized diagram access; the excalidraw-room collaboration server uses Redis without authentication in many deployments exposing all active room state; Firebase configuration keys are embedded in the client-side bundle; and diagram content is often transmitted and stored unencrypted. This guide covers systematic Excalidraw security assessment.

Room ID Enumeration and Unauthorized Diagram Access
Redis and excalidraw-room Server Assessment
Configuration and API Key Extraction
Excalidraw Security Hardening

Room ID Enumeration and Unauthorized Diagram Access

# Excalidraw — room ID enumeration and unauthorized access
EXCALIDRAW_URL="https://draw.example.com"

# Excalidraw collaboration URLs use room IDs in the hash fragment
# Format: https://draw.example.com/#room=ROOM_ID,ENCRYPTION_KEY
# Room IDs shared via chat/email are often predictable or leaked
# in logs, browser history, or Slack message archives

# Test access to a known room ID (collaboration server check)
# The room WebSocket endpoint
ROOM_ID="abcdef123456"
wscat -c "wss://draw.example.com/socket.io/?roomID=${ROOM_ID}" 2>/dev/null

# Or for excalidraw-room server (port 80 in container, often proxied):
curl -s -o /dev/null -w "%{http_code}" \
  "https://draw.example.com/socket.io/?roomID=${ROOM_ID}&transport=polling" 2>/dev/null

# excalidraw-room — the collaboration backend (separate server)
# Check if it's accessible:
curl -s "${EXCALIDRAW_URL}/socket.io/" 2>/dev/null | head -50
# If accessible, any client can connect and join/observe any room by ID

# Room IDs from browser history, Slack, email — common patterns
# Many users use predictable room names:
for ROOM in "architecture" "security-review" "incident-2026" "roadmap" "design"; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    "${EXCALIDRAW_URL}/socket.io/?roomID=${ROOM}&transport=polling" 2>/dev/null)
  echo "Room '${ROOM}': HTTP ${STATUS}"
done

Redis and excalidraw-room Server Assessment

# Excalidraw Redis and excalidraw-room server assessment

# Redis — excalidraw-room stores active room collaboration state
# Test unauthenticated Redis access
redis-cli -h localhost -p 6379 ping 2>/dev/null
# PONG = unauthenticated Redis access

# List all Excalidraw room keys in Redis
redis-cli -h localhost -p 6379 KEYS "*" 2>/dev/null | head -30
# Keys may be: room:ROOM_ID, portal:ROOM_ID, etc.

# Get room state (drawing data in binary/JSON format)
redis-cli -h localhost -p 6379 HGETALL "room:abcdef123456" 2>/dev/null

# Docker environment
docker inspect excalidraw-room 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e for k in ['REDIS', 'PORT', 'SECRET', 'CORS']):
            print(e)
" 2>/dev/null
# REDIS_URL — Redis connection string (may include password)
# CORS — CORS configuration (check for wildcard *)

# excalidraw-room server health check
curl -s "http://localhost:3002/health" 2>/dev/null
# or the configured port (3001, 3002, 8080)

# Check Redis for stored collaboration data
redis-cli -h localhost KEYS "portal:*" 2>/dev/null | while read KEY; do
  echo "Room key: $KEY"
  redis-cli -h localhost TTL "$KEY" 2>/dev/null
  redis-cli -h localhost HLEN "$KEY" 2>/dev/null
done

Configuration and API Key Extraction

# Excalidraw configuration and API key extraction

# .env or .env.production — Excalidraw build configuration
cat /opt/excalidraw/.env 2>/dev/null
cat /opt/excalidraw/.env.production 2>/dev/null
# VITE_APP_FIREBASE_CONFIG — Firebase config JSON (API key, project ID, bucket)
# VITE_APP_WS_SERVER_URL — WebSocket server URL
# VITE_APP_HTTP_STORAGE_BACKEND_URL — storage backend URL
# LIVEBLOCKS_SECRET_KEY — Liveblocks API secret (alternative backend)

# Firebase configuration — often embedded in JS bundle
# Check the built Excalidraw JS for Firebase config
curl -s "${EXCALIDRAW_URL}/" 2>/dev/null | \
  grep -oP '"apiKey":"[^"]+' | head -3
curl -s "${EXCALIDRAW_URL}/" 2>/dev/null | \
  grep -oP '"storageBucket":"[^"]+' | head -3

# Firebase storage bucket test — may allow unauthenticated access
FIREBASE_PROJECT="your-project-id"
STORAGE_BUCKET="your-project.appspot.com"
curl -s "https://firebasestorage.googleapis.com/v0/b/${STORAGE_BUCKET}/o" 2>/dev/null | \
  python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    items = d.get('items',[])
    print(f'Storage objects: {len(items)}')
    for item in items[:5]:
        print(f'  {item.get(\"name\")} ({item.get(\"size\")} bytes)')
except: print('No access or storage secured')
" 2>/dev/null

# Storage backend — Excalidraw+ compatible self-hosted storage
# May be an S3-compatible or custom API with its own credentials
cat /opt/excalidraw-storage/.env 2>/dev/null | grep -E "KEY|SECRET|TOKEN|BUCKET" | head -10

Excalidraw Security Hardening

Excalidraw Security Hardening Checklist:

Use cryptographically random room IDs and treat room URLs as secrets — Excalidraw's collaboration feature uses room IDs embedded in the URL hash fragment; by default, the room ID is what controls access — anyone with the URL can join the room; do not use predictable room names (project names, team names, dates) as room IDs; use the Excalidraw interface's built-in random room ID generation; treat collaboration room URLs like temporary passwords — share them only via secure channels; avoid sharing room URLs in public or logged communication channels (public Slack channels, email threads with external parties); be aware that room URLs may appear in browser history, proxy logs, and link previews
Secure Redis with authentication and network access controls — the excalidraw-room collaboration server uses Redis to store active room collaboration state; in many Docker Compose deployments, Redis is configured without authentication and without network restrictions; Redis without authentication exposed on the network allows reading all active room drawing data, listing all current active rooms, and injecting arbitrary data into rooms; configure Redis with a strong password (requirepass), bind Redis to localhost only (bind 127.0.0.1), and use encrypted Redis connections (TLS); set appropriate key TTLs so room data is automatically cleaned up after sessions end
Audit Firebase storage bucket permissions for Excalidraw deployments — Excalidraw's default cloud configuration uses Firebase for persistent diagram storage; the Firebase storage bucket permissions may be set to allow unauthenticated read or write access (a common Firebase misconfiguration); test your Firebase storage bucket by attempting unauthenticated access to list objects and download files; implement Firebase security rules to require authentication for all reads and writes; be aware that Firebase API keys embedded in client-side JavaScript are public by design but must be paired with proper Firebase security rules — the API key alone does not grant access if rules are correct
Implement network-level access controls for the excalidraw-room WebSocket server — the excalidraw-room server accepts WebSocket connections from any client that can reach it; there is no built-in authentication for room joining — access control relies entirely on room ID secrecy; restrict the excalidraw-room server to be accessible only from the Excalidraw frontend (same-origin or specific allowed origins via CORS); do not expose the excalidraw-room WebSocket server directly to the internet; use a reverse proxy to enforce CORS and origin restrictions; for organizations with user authentication requirements, consider replacing the default excalidraw-room server with an authenticated collaboration backend
Understand that Excalidraw collaboration data is unencrypted in transit between the room server and other participants — while Excalidraw has end-to-end encryption in the URL key (the part after the comma in the room link), the collaboration server handles unencrypted drawing updates in real time; the encryption key is in the URL fragment which is not sent to servers in standard HTTP, providing some protection; however, the excalidraw-room server stores collaboration state and the storage backend stores saved diagrams — implement TLS for all communication; avoid embedding sensitive data (passwords, PII, classified information) in Excalidraw diagrams

Security Test	Method	Risk
Room ID enumeration and unauthorized collaboration join	WebSocket connection to /socket.io/?roomID=GUESSED_ID — join active collaboration rooms; view and modify diagram content in real time; no authentication required by default	High
Redis unauthenticated access — active room state extraction	redis-cli KEYS * + HGETALL room:ID — all active collaboration room drawing data; list all active rooms; no auth in many Docker deployments	High
Firebase storage bucket unauthenticated object listing	GET firebasestorage.googleapis.com/v0/b/{bucket}/o — list and download all saved diagrams if Firebase rules allow unauthenticated access	High
Firebase API key extraction from client bundle	Grep built JS bundle for apiKey, storageBucket — Firebase config embedded in frontend; use extracted config to test Firebase security rule enforcement	Medium
CORS wildcard allowing cross-origin room access	Test CORS headers on excalidraw-room server — if CORS: * is set, any website can make WebSocket connections to the room server as authenticated users	Medium

Automate Excalidraw Security Testing

Ironimo tests Excalidraw deployments for predictable room ID enumeration and unauthorized collaboration join, Redis unauthenticated access and active room state extraction, Firebase storage bucket permission misconfiguration, Firebase API key extraction from client-side JavaScript bundle, CORS wildcard configuration on excalidraw-room server, WebSocket room join without authentication, .env VITE_APP_FIREBASE_CONFIG and REDIS_URL exposure, storage backend credential extraction, and collaboration data interception via WebSocket inspection.

Start free scan

Table of Contents

Room ID Enumeration and Unauthorized Diagram Access

Redis and excalidraw-room Server Assessment

Configuration and API Key Extraction

Excalidraw Security Hardening

Automate Excalidraw Security Testing