skills.rest
cgRGM
cgRGMCOMMUNITY
Explore all skills by this author →
Website𝕏@c_g_stewartGitHub

convex-security-audit

Audit Convex applications for authorization, data access, and action isolation issues.

1|Updated Oct 10, 2025
Search Tags:#authorization#rate limiting#access control#security audit#audit logging#convex#data boundaries
One-click install
npx skills add https://github.com/cgRGM/rivercitymd --skill convex-security-audit-cgrgm
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: convex-security-audit
Source: https://github.com/cgRGM/rivercitymd/tree/main/.cursor/skills/convex-security-audit
Command: npx skills add https://github.com/cgRGM/rivercitymd --skill convex-security-audit-cgrgm

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you review Convex applications for security flaws before they become production incidents, focusing on who can access data, who can perform actions, and how sensitive operations are protected.

Core Features & Use Cases

  • Authorization Review: Check role-based access control, permission checks, and ownership validation across queries, mutations, and actions.
  • Data Boundary Review: Identify overly broad queries, missing user-scoped filters, and leaks of private records or shared resources.
  • Operational Safety Review: Examine external API usage, internal action isolation, rate limiting, audit logging, and destructive admin workflows.
  • Use Case: Use this Skill to assess a Convex-powered customer portal or admin dashboard and produce a prioritized list of security fixes.

Quick Start

Ask the assistant to audit your Convex app for authorization gaps, data exposure, unsafe actions, rate limiting, and destructive-operation safeguards, then return concrete remediation steps.

Frequently Asked Questions about convex-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my Convex app for authorization and data access vulnerabilities?▼

To audit Convex authorization vulnerabilities, review role-based access control, validate ownership filtering in queries, and check permission checks across mutations to prevent unauthorized data exposure.

What security checks are needed before shipping a Convex application to production?▼

Before shipping a Convex app, verify rate limiting, internal action isolation, audit logging, external API handling, and destructive-operation safeguards to harden administrative workflows against production incidents.

How does rate limiting protect Convex mutations and queries from abuse?▼

Rate limiting in Convex prevents abuse by restricting how frequently users can execute queries and mutations, while internal action isolation ensures external API calls and sensitive operations remain protected from unauthorized triggers.

Can this security audit identify overly broad queries leaking private records in Convex?▼

Yes, the security audit identifies overly broad queries by checking for missing user-scoped filters, validating data boundaries, and detecting leaks of private records or shared resources across Convex queries and mutations.

What are common destructive admin workflow risks in Convex applications?▼

Destructive admin workflow risks in Convex include unvalidated role checks on sensitive operations, missing audit logging for administrative changes, and lack of safeguards preventing unauthorized users from triggering destructive mutations.

Related Skills

Explore More Software Engineering Skills→
jcdiv47jcdiv47

function-creator

Create secure, type-safe Convex queries, mutations, and actions.

Community
Advanced
AtemndobsAtemndobs
1

convex-setup-auth

Set up Convex authentication with identity mapping and role-based access control.

Community
Advanced
FlorinSenonerFlorinSenoner

convex-security-audit

Audit Convex application security for authorization, data access, and rate limiting.

Community
Advanced
blocknaviblocknavi
1

convex-security-audit

Review Convex applications for authorization, data access, and action isolation.

Official
Advanced