convex-security-check

Audits Convex applications for authentication, validation, and access control vulnerabilities.

1|Updated Feb 19, 2026

Search Tags:#authorization #authentication #validation #backend #access control #security audit #convex

Ready to run

npx skills add https://github.com/kausthubh-coder/kriyan-web --skill convex-security-check-kausthubh-coder

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: convex-security-check
Source: https://github.com/kausthubh-coder/kriyan-web/tree/main/.cursor/skills/convex-security-check
Command: npx skills add https://github.com/kausthubh-coder/kriyan-web --skill convex-security-check-kausthubh-coder

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Convex applications can ship with exposed public functions, missing authentication checks, weak argument validators, and hardcoded secrets. This Skill provides a structured checklist to audit a Convex backend before deployment. ## Core Features & Use Cases - Five-Area Security Checklist: Covers authentication, function exposure, argument validation, row-level access control, and environment variable handling. - Secure Code Patterns: Provides reference implementations for auth helpers, internal functions, strict validators, and ownership checks. - Use Case: Before deploying a Convex app, run the audit to confirm every query verifies `ctx.auth.getUserIdentity()`, sensitive operations use `internalMutation`, and no `v.any()` validators accept untrusted data. ## Quick Start Audit my Convex backend functions for security issues using the convex-security-check checklist.

Frequently Asked Questions about convex-security-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I secure Convex queries and mutations?▼

Secure Convex functions by calling ctx.auth.getUserIdentity() at the start of every handler and throwing a ConvexError when the identity is null. Then verify the requesting user owns the target document before any update or delete operation.

What is the difference between public and internal functions in Convex?▼

Public functions declared with query, mutation, or action are callable directly from clients, while internalQuery, internalMutation, and internalAction can only be invoked from other Convex functions. Sensitive operations like role changes or credit updates should always use internal variants.

Why is v.any() dangerous in Convex argument validators?▼

v.any() accepts arbitrary client-supplied data without structure checks, allowing attackers to inject unexpected fields into database inserts. Replace it with explicit validators like v.string(), v.id("table"), or v.union of literals for every argument.

How do I implement row-level access control in Convex?▼

Fetch the target document with ctx.db.get, then compare its userId field against the authenticated identity's tokenIdentifier before patching or deleting. Throw a ConvexError when ownership does not match so unauthorized requests are rejected.

Where should API keys be stored in a Convex app?▼

Store API keys in Convex environment variables and access them via process.env only inside actions, never in queries or mutations. Use different keys for development and production deployments and never hardcode secrets in source code.