skills.rest
jal-co
jal-coCOMMUNITY
Explore all skills by this author →
Website𝕏@jalcowastakenGitHub

security-convex

Audit Convex apps for authentication, authorization, and validation risks.

7|2|Updated Jan 18, 2026
Search Tags:#authorization#security#authentication#validation#audit#convex
One-click install
npx skills add https://github.com/jal-co/jalco-opencode --skill security-convex-jal-co
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-convex
Source: https://github.com/jal-co/jalco-opencode/tree/main/opencode/.config/opencode/skills/security-convex
Command: npx skills add https://github.com/jal-co/jalco-opencode --skill security-convex-jal-co

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Convex security auditing helps prevent data exposure and insecure defaults by systematically evaluating authentication, authorization, and input validation patterns across Convex apps.

Core Features & Use Cases

  • Automated risk detection across queries, mutations, actions, HTTP endpoints, and subscriptions.
  • Enforces best practices such as requiring authentication, ownership checks, and server-side input validation.
  • Use Case: proactively scan a Convex project to surface missing validators, IDOR risks, and unsafe HTTP actions, then remediate with recommended patterns.

Quick Start

Run the security scan on your Convex project using scripts/scan.sh to identify public functions without auth, missing validators, and HTTP-action risks.

Frequently Asked Questions about security-convex

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my Convex app for authentication and authorization risks?▼

To audit Convex app security, run a scan script against your project to detect unauthenticated access, insecure configurations, and missing validators across queries, mutations, actions, HTTP endpoints, and subscriptions.

What is IDOR and how do I prevent it in Convex mutations?▼

IDOR (Insecure Direct Object Reference) in Convex happens when client-provided IDs bypass ownership checks. Prevent IDOR by enforcing server-side authorization and ownership validation before processing mutations or queries.

Do I need server-side input validation for Convex HTTP endpoints?▼

Yes, server-side input validation is required for Convex HTTP endpoints to prevent insecure configurations and data exposure. Applying validation patterns ensures only authenticated requests process actions safely.

Can I automate finding missing validators in real-time Convex subscriptions?▼

Yes, you can automate finding missing validators and unauthenticated access in real-time Convex subscriptions by running a dedicated security scan script that evaluates your project against an audit checklist.

What's the best way to secure public functions in a Convex project?▼

The best way to secure public functions in a Convex project is to systematically apply authentication requirements, ownership checks, and server-side input validation, verified through an automated security audit script.

Related Skills

Explore More Software Engineering Skills→
althof3althof3

convex-http-actions

Define and secure HTTP endpoints for Convex applications.

Community
Advanced
IgorWarzochaIgorWarzocha
124

security-convex

Audit Convex applications for authentication, authorization, and input validation vulnerabilities.

Community
Advanced
DW225DW225
1

rbac-security

Enforce role-based access control and authentication on server actions and real-time messages.

Community
Advanced
AcczdyAcczdy
2

performing-web-application-penetration-test

Automate web application penetration testing following the OWASP WSTG with Burp Suite.

Community
Advanced