convex-security-check

Audit Convex applications for authentication, validation, access control, and secret-handling vulnerabilities.

Updated May 4, 2024

Search Tags:#authorization #security #authentication #validation #secrets #convex

Ready to run

npx skills add https://github.com/kcrlee/dots --skill convex-security-check-kcrlee

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: convex-security-check
Source: https://github.com/kcrlee/dots/tree/main/claude/.claude/skills/convex-security-check
Command: npx skills add https://github.com/kcrlee/dots --skill convex-security-check-kcrlee

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you quickly review Convex applications for common security gaps before they reach production.

Core Features & Use Cases

Authentication Review: Check that sensitive queries and mutations verify user identity.
Exposure and Validation Review: Distinguish public functions from internal ones and confirm strict argument validators.
Access and Secrets Review: Verify row-level ownership checks and safe environment variable handling.
Use Case: Use it when auditing a new Convex backend, reviewing a pull request, or hardening an app before launch.

Quick Start

Ask this Skill to review my Convex app for authentication, authorization, validation, access control, and secret-handling issues.

Frequently Asked Questions about convex-security-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit a Convex backend for authentication and authorization vulnerabilities?▼

To audit a Convex backend, review sensitive queries and mutations to ensure they verify user identity and enforce row-level access control. This validates authentication and authorization boundaries before production release.

What is the difference between public and internal functions in Convex security?▼

Distinguishing public from internal functions in Convex security limits client access to sensitive backend operations. Security audits verify these boundaries to prevent unauthorized function exposure.

How do I validate arguments and handle environment variables safely in Convex?▼

Validating arguments in Convex requires applying strict validators to function inputs, while safe environment variable handling ensures secure secret storage. Both practices prevent injection attacks and unauthorized data access.

Can I use this to review row-level access control and secret storage before launching my app?▼

Yes, you can review row-level access control and secret storage before launching a Convex app. The audit verifies ownership enforcement and safe environment variable handling to harden production deployments.

What are common security gaps when exposing Convex mutations and queries?▼

Common security gaps when exposing Convex mutations and queries include missing user identity verification, lacking strict argument validators, and ignoring row-level ownership checks. These exposure and validation flaws allow unauthorized data access.