convex-security-audit

Reviews Convex applications for authorization, data access, rate limiting, and sensitive operation vulnerabilities.

1|Updated Feb 19, 2026

Search Tags:#authorization #rate limiting #access control #security audit #rbac #audit logging #convex

Ready to run

npx skills add https://github.com/kausthubh-coder/kriyan-web --skill convex-security-audit-kausthubh-coder

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: convex-security-audit
Source: https://github.com/kausthubh-coder/kriyan-web/tree/main/.cursor/skills/convex-security-audit
Command: npx skills add https://github.com/kausthubh-coder/kriyan-web --skill convex-security-audit-kausthubh-coder

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Convex applications often ship with missing authorization checks, unprotected data queries, exposed API keys, and no rate limiting, leaving user data and sensitive operations vulnerable to abuse. ## Core Features & Use Cases - Authorization Audits: Implements role-based access control (RBAC) and permission checks with hierarchical roles and structured ConvexError responses. - Data Access Boundary Reviews: Enforces ownership verification, shared-document access lists, and visibility filtering so users only see permitted data. - Action Isolation & Rate Limiting: Keeps API keys in environment variables, uses internal actions for payments, and applies sliding-window rate limits to user-facing mutations. - Use Case: Before deploying a Convex app to production, run this audit to add confirmation codes for destructive admin actions and audit logging for every sensitive operation. ## Quick Start Audit my Convex functions for missing authorization checks, data leaks, and rate limiting gaps.

Frequently Asked Questions about convex-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement role-based access control in Convex?▼

Create a role hierarchy mapping roles to numeric levels, then write a requireRole helper that fetches the authenticated user via ctx.auth.getUserIdentity and throws a ConvexError when their role level is insufficient. Permission-based checks can map roles to allowed actions for finer control.

How to add rate limiting to Convex mutations?▼

Store request timestamps in a rateLimits table indexed by user and action, then count entries within the time window before executing the mutation. If the count exceeds the limit, throw a ConvexError with a retryAfter value so clients know when to retry.

How do I protect API keys in Convex actions?▼

Store keys in environment variables accessed via process.env, never hardcode them or return them in responses. Use internalAction for sensitive operations like payments so they cannot be called directly from clients, and sanitize external API errors before returning.

Does Convex support audit logging for sensitive operations?▼

Yes, use an internalMutation to insert events into an auditLogs table recording the action, user, resource, and timestamp. Restrict log viewing to admin roles with requireRole, and log every destructive or privileged operation for accountability.

Why should destructive admin actions use confirmation codes?▼

Confirmation codes prevent accidental or unauthorized destructive operations like deleting all user data. Generate a short-lived code, require it in the mutation, delete it after use to prevent replay, and schedule the actual deletion via the scheduler with an audit log entry.