convex-security-check

Audit Convex applications for authentication and access control weaknesses.

1|1|Updated Feb 24, 2026
One-click install
npx skills add https://github.com/openridesph/openrides --skill convex-security-check-openridesph
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: convex-security-check
Source: https://github.com/openridesph/openrides/tree/main/.agents/skills/convex-security-check
Command: npx skills add https://github.com/openridesph/openrides --skill convex-security-check-openridesph

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security auditing for Convex applications to identify authentication gaps, function exposure risks, validation gaps, access control weaknesses, and unsafe environment variable handling.

Core Features & Use Cases

  • Auth checks: Verifies user identity before sensitive data access.
  • Function exposure review: Ensures internal functions are not exposed publicly.
  • Argument and returns validation: Enforces strict validators for inputs/outputs.
  • Row-level access control: Confirms ownership and role-based restrictions.
  • Environment variable hygiene: Checks for secrets usage and proper config handling.

Quick Start

Run the Convex Security Checklist against your Convex backend project to identify and remediate gaps in authentication, authorization, and data access.

Frequently Asked Questions about convex-security-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my Convex application for authentication and access control weaknesses?

Auditing Convex application security involves reviewing public vs internal function exposure, enforcing strict argument validators, verifying row-level permissions, and checking session integrity to remediate access control weaknesses.

What is the best way to secure environment variables in a Convex backend?

Securing environment variables in Convex requires robust checks for secrets usage and proper config handling across deployment layers, ensuring sensitive data is isolated from public function exposure and unsafe client access.

How do I implement row-level access control and RBAC in Convex functions?

Implementing row-level access control in Convex functions requires confirming data ownership and applying role-based restrictions, ensuring user identity is verified through strict authentication checks before sensitive data access.

How do I prevent internal Convex functions from being exposed publicly?

Preventing internal Convex functions from public exposure requires reviewing access controls to ensure sensitive operations remain internal, enforcing strict validators, and applying session integrity checks to gate public endpoints.

Does Convex security auditing work for both web and native application layers?

Convex security auditing applies across web and native layers, checking session integrity, environment variable handling, and authentication consistency to secure access controls regardless of the deployment platform.