Excalidraw is a drawing interface that teams use for architecture sketches, incident diagrams, and product flows. The open-source editor can be embedded in another application, and a self-hosted front end may not include the collaboration service that a hosted product provides. That distinction is critical when a search result is treated as a public shared canvas.

What ZoomEye returned

On 2026-11-03T04:15:47Z, a count-only query with page=1, pagesize=1, and sub_type=all returned 5,512 total matches for title="Excalidraw". The same run returned 0 for app="Excalidraw". The title query is the only positive signal in this batch. It identifies pages that use the name, not pages that contain accessible drawings.

The official developer documentation states that self-hosting the editor does not by itself support sharing or collaboration features. A deployment may add its own collaboration backend, authentication, and storage, but those are host-application decisions. A public editor page is not proof of a public room, and an application fingerprint is not proof of a shared document.

Determine what the host application built

Excalidraw exposes APIs that a host application can use for its own collaboration and storage. The host must decide where scene data lives, how a room is authorized, who can join, and how a link expires. Review the application rather than assuming that the editor package provides those controls.

A self-hosted page may be a static editor with no server storage. In that case, the risk is mostly the hosting page, embedded assets, and any local file handling. A collaboration-enabled deployment adds websocket traffic, room state, user presence, and persistence. The data path and the authentication requirements are different.

If the host uses room links, treat them as bearer capabilities until the application proves otherwise. Record whether a room can be viewed, edited, or deleted by someone with only the URL. Test whether a new session can join after the room owner leaves and whether the room expires.

Review the embedding boundary

An embedded Excalidraw component runs inside a larger application. The host controls the page origin, content security policy, file downloads, and authentication. Check that a canvas cannot load an arbitrary external script or image without review. Test the export and clipboard paths, because they can move confidential diagrams outside the application.

Use a restrictive content security policy for the host and the editor. Do not disable protections just to make a collaboration library work. If the host allows custom fonts, images, or libraries, validate the source and the update process.

Keep the editor and any collaboration service patched separately. A static front end can be updated by rebuilding the bundle, while a websocket service may run as another container. Confirm the running versions from package or image metadata, not from the page title.

Use the title count as a starting point

Join the matches to owned domains and application inventories. For an owned page, identify the host application, authentication method, storage backend, and sharing model. For an unknown page, attribute the domain before interacting. Do not test room IDs or download diagrams.

Monitor new matches under organization-owned domains. A title change can reflect a proxy, a custom build, or a migration. Keep a configuration-management record so the team does not depend on a public HTML match for maintenance.

The defensible statement is narrow: ZoomEye found 5,512 pages in the selected scope whose title contains Excalidraw. It did not find 5,512 public drawing rooms. The product's own documentation makes the collaboration boundary a host-application responsibility, so any exposure conclusion must come from the host's authentication and storage design.

References