convex-security-check

Enforce security checks for Convex applications across authentication, validators, and access control.

Updated Feb 26, 2026

Search Tags:#authorization #security #authentication #validation #audit #convex #access-control

Ready to run

npx skills add https://github.com/NitzanSelwyn/MomentumTrackerAdmin --skill convex-security-check-nitzanselwyn

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: convex-security-check
Source: https://github.com/NitzanSelwyn/MomentumTrackerAdmin/tree/main/.claude/skills/Convex%20Security%20Check
Command: npx skills add https://github.com/NitzanSelwyn/MomentumTrackerAdmin --skill convex-security-check-nitzanselwyn

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This checklist helps teams perform a quick, repeatable security review of Convex applications, focusing on authentication, function exposure, input validation, row-level access control, and environment variable handling.

Core Features & Use Cases

Comprehensive authentication and identity checks across queries, mutations, and actions
Review of function exposure, internal vs public usage, and origin validation
Validation of arguments, returns, and ownership controls
Guidance on environment variable hygiene and secret management
Use case: verify that an admin-only operation cannot be invoked by regular users

Quick Start

Run this checklist against your Convex project to validate authentication, access control, validators, and environment variable handling.

Frequently Asked Questions about convex-security-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a security audit on my Convex application?▼

To perform a Convex security audit, run a checklist that verifies authentication, function exposure, argument validation, row-level access control, and environment variable handling across all queries, mutations, and actions.

What security checks should I run for Convex functions and mutations?▼

Security checks for Convex functions must verify strict argument validators, proper role checks, row-level ownership controls, and ensure sensitive data or secrets are not exposed to unauthorized users.

How do I prevent unauthorized users from invoking admin-only operations in Convex?▼

Prevent unauthorized access to admin-only operations by enforcing proper role checks and row-level access control within your Convex mutations and queries to validate user identity and permissions.

How does environment variable and secret handling affect Convex application security?▼

Environment variable hygiene in Convex security involves reviewing secret management practices to ensure sensitive data and environment variables are properly secured and never exposed through public function returns.

Can I use this security checklist to review internal versus public function exposure in Convex?▼

Yes, this security checklist reviews function exposure by validating internal versus public usage and origin validation across Convex queries, mutations, and actions to prevent unauthorized invocation.

What is the best way to implement row-level access control in Convex?▼

Implementing row-level access control in Convex requires applying strict validators and ownership controls within queries and mutations to ensure users can only access data they are authorized to view.