convex-security-check

Identify and remediate security issues in Convex applications.

Updated Feb 8, 2026

Search Tags:#authorization #security #authentication #validation #audit #devsecops #convex

Ready to run

npx skills add https://github.com/gursheyss/styx --skill convex-security-check-gursheyss

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: convex-security-check
Source: https://github.com/gursheyss/styx/tree/main/.agents/skills/convex-security-check
Command: npx skills add https://github.com/gursheyss/styx --skill convex-security-check-gursheyss

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Quick security audit checklist covering authentication, function exposure, argument validation, row-level access control, and environment variable handling.

Core Features & Use Cases

Provides a practical, repeatable security checklist for Convex apps.
Focuses on authentication, function exposure, input validation, and environment variable safety.
Use case: teams auditing Convex server-side code to reduce risk and improve compliance.

Quick Start

Follow the checklist to start a fast security review of your Convex project.

Frequently Asked Questions about convex-security-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run a security audit on my Convex application?▼

Audit your Convex application by applying a security checklist that verifies authentication boundaries, function exposure limits, argument validation, and row-level access controls across server-side functions.

What security checks should I perform on Convex server-side functions?▼

Security checks for Convex server-side functions include enforcing proper access controls, documenting explicit validators for arguments and returns, and verifying safe environment variable handling across all code paths.

How do I prevent unauthorized function exposure in Convex?▼

Prevent unauthorized function exposure in Convex by defining safe exposure boundaries and enforcing ownership checks to ensure only authenticated users can invoke specific server-side operations.

Does this security checklist cover input validation for Convex args?▼

Yes, the security checklist requires documenting explicit validators for Convex args and returns, ensuring parameter validation is enforced across all server-side code paths to prevent malicious inputs.

Can I use this to audit environment variable handling in Convex apps?▼

Yes, you can audit environment variable handling in Convex apps to verify sensitive configurations are securely managed and not improperly exposed across server-side function code paths.