tldraw Sync Makes Room Identity the Security Boundary

tldraw is an infinite-canvas SDK with a real-time collaboration layer called tldraw sync. A ZoomEye count-only probe on November 15, 2026 returned no app="tldraw" matches, 106 title="tldraw" matches, and 1,375 http.body="tldraw" matches. The scope was sub_type=all, page 1, and page size 1.

The counts are textual observations. A tldraw integration can be embedded in a larger application, so the response may not identify the product in the title. A body match can be a documentation page. The absent application fingerprint means the engine did not return a tldraw signature for this query, not that no collaboration service exists.

Room IDs are not authorization

The tldraw collaboration documentation describes a room as the unit of synchronization. A demo hook lets anyone who opens the same roomId see the same document and each other's cursors. The documentation also says production sync integrations need to provide authentication, authorization, rate limiting, asset size limits, and document history where the application requires them.

That list is a useful security checklist. If an application uses a predictable room ID or a share link without an authorization check, possession of the link may become the only access control. The ID should not be treated as a secret unless the design explicitly accepts that model and protects it from logs, referrers, and third-party scripts.

The sync service should verify the user's right to the document before the WebSocket session is admitted. It should also re-check access when a session reconnects or when the document is moved. A token issued for one room should not be accepted for another.

Collaboration is a data channel

Canvas content can contain text, images, links, comments, and embedded assets. The sync protocol is a data channel for those changes. Apply size limits to messages and assets, validate the document schema, and prevent a client from attaching an object type that the server does not allow.

Rate limiting protects availability and storage. Document history needs its own retention policy. A service that stores every update without a limit can turn a legal collaboration session into a large archive. A service that drops history without an owner decision can make an incident investigation impossible.

Review the signaling and WebSocket endpoints together. A reverse proxy may authenticate the initial page but allow a direct sync endpoint to bypass the same policy. Confirm that the network path to the sync server is intentional and that the server validates the session token rather than trusting a room ID in the URL.

Use the matches as discovery

The 106 title and 1,375 body matches can identify pages that mention tldraw or use the library. A title match can be a demo canvas. A body match can be a release note. Neither is proof that collaboration is enabled.

Start with pages that show a canvas interface or a sync connection. Record the application owner, room creation flow, share-link behavior, authentication method, asset storage, and history retention. Avoid joining rooms that belong to another organization.

For a confirmed service, test with two accounts that should not see the same document. Confirm that a room ID from one account is rejected for the other. Test reconnect behavior and the expiry of a share link. A successful canvas load does not prove that the authorization boundary works.

Make the count useful

The absence of an application fingerprint means a product-name query may undercount integrations. The title and body counts can still support a manual review of likely demos and documentation. Keep the exact dorks and the observation time in the report.

tldraw's value is the collaborative document. The security boundary is the room, the identity that can enter it, the changes it can send, and the history it can read. The ZoomEye result finds candidate interfaces for that boundary review.

References

• tldraw sync documentation
• tldraw collaboration documentation
• ZoomEye count evidence for this article