skills.rest
get-convex
get-convexOFFICIAL
Explore all skills by this author →
Website𝕏@convex_devGitHub

sec-check

Identify and mitigate security risks in Convex code reviews.

9|3|Updated Nov 28, 2025
Search Tags:#security#webhooks#code-review#auth#convex#access-control#data-privacy
One-click install
npx skills add https://github.com/get-convex/components-submissions-directory --skill sec-check-get-convex
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sec-check
Source: https://github.com/get-convex/components-submissions-directory/tree/main/.claude/skills/sec-check
Command: npx skills add https://github.com/get-convex/components-submissions-directory --skill sec-check-get-convex

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security reviews for Convex apps can miss critical gaps in authentication, access control, data handling, and integrations. This skill provides a repeatable checklist to identify and remediate these risks during code reviews.

Core Features & Use Cases

  • Auth and ownership checks: validate that only authorized users perform sensitive operations and verify ownership patterns.
  • Data exposure controls: ensure PII or internal metadata is not exposed in public APIs or frontend payloads.
  • Safe integration practices: verify use of internal wrappers, proper webhook handling, and secret management.
  • AI-generated code review: assess safety of AI-generated code and prompts to avoid leakage or insecure patterns.

Quick Start

Review the current Convex codebase focusing on authentication, access control, data exposure, and integration security.

Frequently Asked Questions about sec-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a security review for my Convex app code?▼

Perform a Convex security review by applying a comprehensive checklist to mutations, auth logic, and public queries. This process enforces authentication, verifies ownership checks, and restricts data exposure to mitigate risks during code reviews.

What security checks are needed for Convex webhooks and integrations?▼

Security checks for Convex webhooks involve verifying proper webhook handling, validating secret management, and ensuring the use of internal wrappers. Safe integration practices prevent unauthorized access and protect sensitive payload data.

How do I prevent PII data exposure in Convex public queries?▼

Prevent PII data exposure in Convex public queries by enforcing data exposure controls. Review your frontend payloads and internal metadata to ensure sensitive information is not accessible through unauthorized public APIs.

Does this security checklist review AI-generated code handling user data?▼

Yes, this security checklist reviews AI-generated code handling user data by assessing prompt safety and preventing insecure patterns. It identifies potential data leakage risks within AI-generated mutations and queries.

Can I use this checklist to verify access control and ownership patterns in Convex mutations?▼

Yes, you can use the checklist to verify access control in Convex mutations. It validates that only authorized users perform sensitive operations and checks ownership patterns to remediate access vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
waynesuttonwaynesutton
5

sec-check

Enforce secure coding practices in Convex code reviews.

Community
Advanced
PosteriotPosteriot

security-auditor

Audit Makalah app auth, permissions, APIs, webhooks, and data exposure.

Community
Advanced
PolarCoding85PolarCoding85
17

convex-clerk

Integrate Clerk authentication with Convex using ConvexProviderWithClerk and webhooks.

Community
Advanced
ShankulkarniShankulkarni
1

audit-vibecode-patterns

Detects AI-generated slop patterns in JavaScript/TypeScript codebases.

Community
Intermediate