What problem does it solve? Convex backends often ship with exploitable authorization gaps: client-supplied identity arguments that enable impersonation, missing per-document ownership checks, PII-leaking public queries, and writes into containers the caller does not own. This Skill finds and fixes those four defect shapes systematically instead of relying on ad-hoc review. ## Core Features & Use Cases - Deterministic four-shape scan: Regex-based detection of identity-from-arg, missing-ownership-check, PII-leaking queries, and parent-reference write violations across all convex/**/*.ts files, reporting file and line for every hit. - Canonical hardening: Applies the requireIdentity/requireOwner pattern from convex-expert.md verbatim, resolving users-table rows by auth subject when ownership is keyed by Id<"users">. - Foundation gating: Verifies auth.config.ts and a subject-keyed users table exist before injecting ctx.auth enforcement; on foundationless apps it converts privileged functions to internalQuery/internalMutation instead. - Use Case: Before launching a multi-tenant SaaS on Convex, run the audit to confirm no public mutation lets one tenant read or write another tenant's rows, then verify the fixes with tsc. ## Quick Start Audit my Convex backend for authorization vulnerabilities and fix any issues you find.
