{
  "schemaVersion": 1,
  "type": "resource",
  "id": "tldraw",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "browser",
      "source-review"
    ],
    "summary": "The official basic example created one rectangle, removed it with Undo and restored it with Redo. No service-write or WebSocket request was allowed. Persistence, collaboration, uploads and production-license behavior were not tested.",
    "reportUrl": "/design-evaluations/resource-tldraw.json",
    "identity": {
      "target": "https://examples.tldraw.com/basic/full",
      "version": "Unversioned public build observed 2026-10-19",
      "integrity": "Entry-response SHA-256 db15b4efa9f78c814ca87572098ccc691a8a805e54c0e18552d6bebe24aac696; not whole-application integrity."
    },
    "environment": [
      "Chromium 155.0.8059.82; fresh disposable browser context, no account state or ambient credential variables.",
      "Synthetic inputs only; no uploads, purchases, accounts or private data.",
      "Exact allowlisted public HTTPS origins with GET/HEAD; credentials, non-default ports, forms, downloads, service writes, auth/telemetry routes and WebSockets blocked. Restrictions may change page behavior."
    ],
    "tests": [
      {
        "name": "Public application entry",
        "mode": "browser",
        "method": "Load fresh browser document and inspect visible controls",
        "result": "pass",
        "observation": "HTTP 200; 45 sampled button controls, 0 visible inputs. Reachability alone does not establish product functionality."
      },
      {
        "name": "Draw a rectangle",
        "mode": "browser",
        "method": "Select observed Rectangle tool and drag a synthetic shape on blank basic-example canvas",
        "result": "pass",
        "observation": "{\"before\":0,\"created\":1}"
      },
      {
        "name": "Undo shape creation",
        "mode": "browser",
        "method": "Activate observed Undo button",
        "result": "pass",
        "observation": "{\"created\":1,\"undone\":0}"
      },
      {
        "name": "Redo shape creation",
        "mode": "browser",
        "method": "Activate observed Redo button",
        "result": "pass",
        "observation": "{\"redone\":1}"
      },
      {
        "name": "Persistence and collaboration",
        "mode": "browser",
        "method": "Save/reload or share a multi-user canvas",
        "result": "not-run",
        "observation": "The basic anonymous example was used without persistence or collaboration; no server data or room was created."
      }
    ],
    "security": {
      "scope": "Passive inspection of the named public response headers, requested origins and bounded public controls. No exploitation, authentication or backend permission tests.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "The basic sample worked without a write request",
          "detail": "The isolated public example moved through 0→1→0→1 rendered shapes. No blocked service-write/WebSocket attempt was recorded in this run; that does not establish the network behavior of other examples or integrations."
        },
        {
          "level": "caution",
          "basis": "documented",
          "title": "Production licensing and trial telemetry are explicit",
          "detail": "Official SDK guidance requires an applicable production license/key and describes trial-license usage pings. License enforcement and telemetry behavior were not tested or modified."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "The application must protect its canvas records",
          "detail": "Validate records and assets and enforce authorization on the server that owns persistence or collaboration. A working local editor is not an access-control system."
        }
      ],
      "limits": [
        "No reload persistence, asset transfer, upload, multiplayer room, synchronization server, authorization, custom record or production license test.",
        "No complete dependency/vulnerability audit, authenticated data access, server authorization, retention or production security certification."
      ]
    },
    "practicalCaveats": [
      "Prototype a small domain-specific shape set before adding custom tools and collaboration.",
      "Test non-canvas task access, keyboard paths and recovery from interrupted saves in the actual application."
    ],
    "limits": [
      "Official mutable basic example, one rectangle and two history controls; no pinned SDK build.",
      "No reload persistence, asset transfer, upload, multiplayer room, synchronization server, authorization, custom record or production license test."
    ],
    "sources": [
      {
        "label": "Basic component example",
        "url": "https://tldraw.dev/examples/basic"
      },
      {
        "label": "SDK licensing and data collection",
        "url": "https://tldraw.dev/community/license"
      },
      {
        "label": "Persistence concepts",
        "url": "https://tldraw.dev/docs/persistence"
      },
      {
        "label": "Dated repository snapshot source",
        "url": "https://github.com/tldraw/tldraw"
      },
      {
        "label": "Evaluated public sample",
        "url": "https://examples.tldraw.com/basic/full"
      }
    ]
  }
}