convex-security-check

Audit Convex projects for authentication, access control, and validator gaps.

1|1|Updated Apr 13, 2026
One-click install
npx skills add https://github.com/Cheggin/request-for-startups --skill convex-security-check-cheggin
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: convex-security-check
Source: https://github.com/Cheggin/request-for-startups/tree/main/skills/convex-security-check
Command: npx skills add https://github.com/Cheggin/request-for-startups --skill convex-security-check-cheggin

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Quick Convex security audit checklist that helps teams identify and remediate security gaps across authentication, function exposure, argument validation, row-level access, and environment variable handling.

Core Features & Use Cases

  • Authentication and access control validation to ensure only authorized users can access data.
  • API exposure and input validation checks to prevent unintended public exposure and enforce validators.
  • Use Case: run this checklist on a Convex project to surface misconfigurations such as public functions or missing environment keys.

Quick Start

Run this checklist against your Convex project to surface security gaps and begin remediation.

Frequently Asked Questions about convex-security-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit security and access control in my Convex application?

Audit Convex security by running a checklist that verifies authentication, function exposure, argument validation, row-level access control, and environment variable handling to identify and remediate security gaps.

What is row-level access control and how does it work in Convex?

Row-level access control in Convex ensures only authorized users access specific data by enforcing ownership checks. It verifies secure access patterns so users cannot query or mutate records they do not own.

How do I prevent unintended public exposure of Convex API functions?

Prevent unintended public exposure of Convex functions by checking API exposure levels and using internal functions for sensitive operations, ensuring only intended endpoints are publicly accessible.

Why does my Convex application need strict argument validation?

Strict argument validation in Convex prevents invalid or malicious input from reaching your database logic. Enforcing validators on all function inputs secures data integrity and blocks unauthorized access attempts.

How do I verify environment variable configuration for sensitive keys in Convex?

Verify environment variable configuration in Convex by checking that sensitive keys are correctly set and handled. A security audit surfaces missing environment keys and ensures secrets are not exposed.

Can I use this security checklist for common Convex use cases and project scales?

Yes, this security checklist applies to common Convex use cases across projects. It verifies secure access patterns, validators, and access checks regardless of scale, ensuring comprehensive security coverage.