By morning, the incident was contained. No leaked assets remained on public CDNs. The 1,240 users received a clear notice: “Your Scrapbook privacy was temporarily impacted due to an SDK bug. No unauthorized access occurred beyond cached thumbnails. We have rotated your credentials.”
The SDK was elegant. OAuth 2.1 with a custom PKCE extension. A shared JWT that carried both the user’s Artify asset manifest and their CordChat role permissions. The killer feature: "Live Canvas," where five friends could edit the same Picsart-style image inside a CordChat voice channel. picsart account discord sdk
They built it in two weeks.
By morning, the incident was contained. No leaked assets remained on public CDNs. The 1,240 users received a clear notice: “Your Scrapbook privacy was temporarily impacted due to an SDK bug. No unauthorized access occurred beyond cached thumbnails. We have rotated your credentials.”
The SDK was elegant. OAuth 2.1 with a custom PKCE extension. A shared JWT that carried both the user’s Artify asset manifest and their CordChat role permissions. The killer feature: "Live Canvas," where five friends could edit the same Picsart-style image inside a CordChat voice channel.
They built it in two weeks.