convex-security-check

The Convex Security Check skill provides a structured, rapid security audit framework for applications built with Convex. It is designed to help developers systematically identify and address potential security vulnerabilities, ensuring that authentication, authorization, and data access patterns adhere to best practices. By offering a clear checklist and example implementations, this skill reduces the risk of exposing sensitive operations, mishandling user data, or misconfiguring environment variables, all of which are common sources of security incidents in modern web applications.

Key features include a comprehensive security checklist that covers authentication setup, function exposure, argument validation, row-level access control, and proper handling of environment variables. The skill provides concrete examples of secure coding patterns, including how to enforce authentication for queries, differentiate public and internal function access, validate function arguments rigorously, and protect API keys and secrets. It emphasizes careful review of publicly exposed functions, proper role-based access enforcement, and the correct separation of development and production credentials, supporting developers in maintaining robust security standards across all aspects of their Convex application.

This skill is particularly useful for web developers, backend engineers, and security-conscious teams who deploy applications on Convex. It supports developers conducting internal audits, preparing for production deployment, or establishing organizational security guidelines. By following the provided checklist and examples, users can streamline the security review process, mitigate potential vulnerabilities before they reach production, and ensure that applications meet both functional and regulatory security requirements.