convex-security-audit

Reviews Convex backend code for authorization, data access, rate limiting, and sensitive operation vulnerabilities.

Updated Jun 28, 2026

Search Tags:#authorization #rate limiting #access control #security audit #rbac #convex #backend security

Ready to run

npx skills add https://github.com/AO-HyS/aohys.com --skill convex-security-audit-ao-hys

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: convex-security-audit
Source: https://github.com/AO-HyS/aohys.com/tree/main/.agents/skills/convex-security-audit
Command: npx skills add https://github.com/AO-HyS/aohys.com --skill convex-security-audit-ao-hys

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Convex applications often ship with authorization gaps, missing ownership checks, unprotected actions, and no rate limiting, exposing user data and sensitive operations to abuse. ## Core Features & Use Cases - Authorization Audits: Review RBAC role hierarchies and permission-based checks using getUser, requireRole, and requirePermission patterns. - Data Access Boundary Checks: Verify ownership filtering, shared document access lists, and visibility rules so users only see permitted data. - Action Isolation & Rate Limiting: Audit external API calls for key exposure, enforce internal-only actions, and implement per-user rate limits with audit logging. - Use Case: Before launching a Convex app, run a security review to confirm payment processing is an internalAction, destructive mutations require confirmation codes, and all sensitive operations write audit log entries. ## Quick Start Audit my Convex functions for authorization flaws, missing ownership checks, exposed API keys, and absent rate limiting.

Frequently Asked Questions about convex-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit Convex functions for security vulnerabilities?▼

Review five areas: authorization logic with role checks, data access boundaries with ownership filtering, action isolation for external API calls, rate limiting on user-facing mutations, and protection of sensitive operations with confirmation codes and audit logs.

How to implement role-based access control in Convex?▼

Create a getUser helper that resolves the identity via ctx.auth.getUserIdentity, then use requireRole with a role hierarchy or requirePermission with per-role permission lists. Throw ConvexError with UNAUTHENTICATED or FORBIDDEN codes when checks fail.

Should Convex payment processing use public or internal actions?▼

Payment processing must use internalAction so it is never exposed to clients. Keep secret keys like Stripe credentials in environment variables, and trigger the internal action only from server-side mutations or schedulers.

How do I add rate limiting to Convex mutations?▼

Store request timestamps in a rateLimits table indexed by user and action, count requests within the time window, and reject with a RATE_LIMITED ConvexError including retryAfter when the threshold is exceeded.

Why should Convex queries return null instead of errors for unauthorized access?▼

Returning null avoids revealing whether a resource exists, preventing enumeration attacks. Verify ownership or shared access records before returning sensitive documents, and only expose public-visibility content to unauthenticated users.