convex-security-audit

Audit Convex apps for authorization, data boundaries, and external API safety.

Updated Apr 10, 2026

Search Tags:#authorization #security #audit #rbac #rate-limiting #convex #data-boundaries

Ready to run

npx skills add https://github.com/qdhenry/Foundry-OSS --skill convex-security-audit-qdhenry

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: convex-security-audit
Source: https://github.com/qdhenry/Foundry-OSS/tree/main/.agents/skills/convex-security-audit
Command: npx skills add https://github.com/qdhenry/Foundry-OSS --skill convex-security-audit-qdhenry

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Convex Security Audit provides a structured, end-to-end security review for Convex applications, covering authorization, data access boundaries, action isolation, rate limiting, and protection of sensitive operations.

Core Features & Use Cases

Enforces role-based access controls and permissions across Convex server functions.
Audits data visibility and access boundaries to prevent leakage and misuse.
Guards external API interactions by isolating sensitive calls and logging usage.
Implements rate limiting and safe operation controls to prevent abuse.
Supports secure workflows for destructive actions with audits and approvals.

Quick Start

Run a full security audit against your Convex app to verify RBAC, data boundaries, and safe external calls.

Frequently Asked Questions about convex-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit authorization and data access boundaries in my Convex app?▼

To audit authorization and data boundaries in a Convex app, run a full security audit to enforce role-based access controls, verify data visibility, and prevent leakage across API calls and data stores.

What is the best way to implement role-based access control for Convex server functions?▼

The best way to implement RBAC for Convex server functions is by applying typed access controls and boundary checks, ensuring permissions are strictly enforced and sensitive operations are protected.

Can I secure external API interactions and prevent abuse with rate limiting in Convex?▼

Yes, you can secure external API interactions in Convex by isolating sensitive calls, logging usage, and implementing rate limiting to control operation frequency and prevent system abuse.

Does this security audit support workflows for destructive actions requiring approvals?▼

Yes, the security audit supports secure workflows for destructive actions by enforcing typed access controls, audit logging, and robust error handling to require approvals and track sensitive operations.

When do I need to run an end-to-end security audit on my Convex application?▼

You need to run an end-to-end security audit when your Convex application requires strict RBAC, data boundaries, rate limiting, and protection of sensitive operations across API calls and data stores.