convex-security-check

Audits Convex applications for authentication, validation, and access control vulnerabilities.

Updated May 28, 2026

Search Tags:#authorization #authentication #validation #backend #access control #security audit #convex

Ready to run

npx skills add https://github.com/mrisoli/pokerhouse --skill convex-security-check-mrisoli

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: convex-security-check
Source: https://github.com/mrisoli/pokerhouse/tree/main/.agents/skills/convex-security-check
Command: npx skills add https://github.com/mrisoli/pokerhouse --skill convex-security-check-mrisoli

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes assets (resource) components.

What problem does it solve? Convex applications can ship with exposed public functions, missing authentication checks, weak argument validators, and hardcoded secrets. This Skill provides a structured checklist and code patterns to audit a Convex backend before deployment. ## Core Features & Use Cases - Five-Area Security Checklist: Covers authentication, function exposure, argument validation, row-level access control, and environment variable handling. - Secure Code Patterns: Provides reference implementations for requireAuth helpers, internal functions, ownership verification, and admin role checks using Convex validators. - Use Case: Before deploying a Convex app, run the audit to confirm every public query checks ctx.auth.getUserIdentity(), sensitive operations use internalMutation, and no v.any() validators accept untrusted data. ## Quick Start Audit my Convex backend functions for missing authentication checks, exposed internal operations, and weak argument validation.

Frequently Asked Questions about convex-security-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I secure Convex functions with authentication?▼

Check ctx.auth.getUserIdentity() at the start of every sensitive query or mutation and throw a ConvexError if no identity exists. Wrap this in a reusable requireAuth helper so all protected functions enforce authentication consistently.

What is the difference between public and internal functions in Convex?▼

Public functions declared with query, mutation, or action are callable directly from clients, while internalQuery, internalMutation, and internalAction can only be invoked from other Convex functions. Sensitive operations like role changes should always use internal variants.

How do I implement row-level access control in Convex?▼

Fetch the document by ID, compare its owner field against the authenticated user's identity, and throw a ConvexError if they do not match. Apply this ownership check before every update and delete operation.

Why is using v.any() in Convex validators dangerous?▼

v.any() accepts arbitrary client-supplied data, allowing attackers to inject unexpected fields into database inserts. Use explicit validators like v.string(), v.id("table"), and v.union() so only intended shapes pass validation.

Where should API keys be stored in a Convex app?▼

Store API keys in Convex environment variables and access them via process.env only inside actions, never in queries or mutations. Use different keys for development and production deployments and never commit secrets to code.