convex-security-check

Name: convex-security-check
Author: waynesutton

106installs31forks

How to install convex-security-check?

waynesutton/convexskills/convex-security-check

$npx -y skills add waynesutton/convexskills --skill convex-security-check

Installs into the current project.

Summary

Quick security audit checklist covering authentication, function exposure, argument validation, row-level access control, and environment variable handling

Files · 1

View on GitHub

SKILL.md

1	# Convex Security Check
2
3	A quick security audit checklist for Convex applications covering authentication, function exposure, argument validation, row-level access control, and environment variable handling.
4
5	## Documentation Sources
6
7	Before implementing, do not assume; fetch the latest documentation:
8
9	- Primary: https://docs.convex.dev/auth
10	- Production Security: https://docs.convex.dev/production
11	- Functions Auth: https://docs.convex.dev/auth/functions-auth
12	- For broader context: https://docs.convex.dev/llms.txt
13
14	## Instructions
15
16	### Security Checklist
17
18	Use this checklist to quickly audit your Convex application's security:
19
20	#### 1. Authentication
21
22	- [ ] Authentication provider configured (Clerk, Auth0, etc.)
23	- [ ] All sensitive queries check `ctx.auth.getUserIdentity()`
24	- [ ] Unauthenticated access explicitly allowed where intended
25	- [ ] Session tokens properly validated
26
27	#### 2. Function Exposure
28
29	- [ ] Public functions (`query`, `mutation`, `action`) reviewed
30	- [ ] Internal functions use `internalQuery`, `internalMutation`, `internalAction`
31	- [ ] No sensitive operations exposed as public functions
32	- [ ] HTTP actions validate origin/authentication
33
34	#### 3. Argument Validation
35
36	- [ ] All functions have explicit `args` validators
37	- [ ] All functions have explicit `returns` validators
38	- [ ] No `v.any()` used for sensitive data
39	- [ ] ID validators use correct table names
40
41	#### 4. Row-Level Access Control
42
43	- [ ] Users can only access their own data
44	- [ ] Admin functions check user roles
45	- [ ] Shared resources have proper access checks
46	- [ ] Deletion functions verify ownership
47
48	#### 5. Environment Variables
49
50	- [ ] API keys stored in environment variables
51	- [ ] No secrets in code or schema
52	- [ ] Different keys for dev/prod environments
53	- [ ] Environment variables accessed only in actions
54
55	### Authentication Check
56
57	```typescript
58	// convex/auth.ts
59	import { query, mutation } from "./_generated/server";
60	import { v } from "convex/values";
61	import { ConvexError } from "convex/values";
62
63	// Helper to require authentication
64	async function requireAuth(ctx: QueryCtx \| MutationCtx) {
65	const identity = await ctx.auth.getUserIdentity();
66	if (!identity) {
67	throw new ConvexError("Authentication required");
68	}
69	return identity;
70	}
71
72	// Secure query pattern
73	export const getMyProfile = query({
74	args: {},
75	returns: v.union(v.object({
76	_id: v.id("users"),
77	name: v.string(),
78	email: v.string(),
79	}), v.null()),
80	handler: async (ctx) => {
81	const identity = await requireAuth(ctx);
82
83	return await ctx.db
84	.query("users")
85	.withIndex("by_tokenIdentifier", (q) =>
86	q.eq("tokenIdentifier", identity.tokenIdentifier)
87	)
88	.unique();
89	},
90	});
91	```
92
93	### Function Exposure Check
94
95	```typescript
96	// PUBLIC - Exposed to clients (review carefully!)
97	export const listPublicPosts = query({
98	args: {},
99	returns: v.array(v.object({ /* ... */ })),
100	handler: async (ctx) => {
101	// Anyone can call this - intentionally public
102	return await ctx.db
103	.query("posts")
104	.withIndex("by_public", (q) => q.eq("isPublic", true))
105	.collect();
106	},
107	});
108
109	// INTERNAL - Only callable from other Convex functions
110	export const _updateUserCredits = internalMutation({
111	args: { userId: v.id("users"), amount: v.number() },
112	returns: v.null(),
113	handler: async (ctx, args) => {
114	// This cannot be called directly from clients
115	await ctx.db.patch(args.userId, {
116	credits: args.amount,
117	});
118	return null;
119	},
120	});
121	```
122
123	### Argument Validation Check
124
125	```typescript
126	// GOOD: Strict validation
127	export const createPost = mutation({
128	args: {
129	title: v.string(),
130	content: v.string(),
131	category: v.union(
132	v.literal("tech"),
133	v.literal("news"),
134	v.literal("other")
135	),
136	},
137	returns: v.id("posts"),
138	handler: async (ctx, args) => {
139	const identity = await requireAuth(ctx);
140	return await ctx.db.insert("posts", {
141	...args,
142	authorId: identity.tokenIdentifier,
143	});
144	},
145	});
146
147	// BAD: Weak validation
148	export const createPostUnsafe = mutation({
149	args: {
150	data: v.any(), // DANGEROUS: Allows any data
151	},
152	returns: v.id("posts"),
153	handler: async (ctx, args) => {
154	return await ctx.db.insert("posts", args.data);
155	},
156	});
157	```
158
159	### Row-Level Access Control Check
160
161	```typescript
162	// Verify ownership before update
163	export const updateTask = mutation({
164	args: {
165	taskId: v.id("tasks"),
166	title: v.string(),
167	},
168	returns: v.null(),
169	handler: async (ctx, args) => {
170	const identity = await requireAuth(ctx);
171
172	const task = await ctx.db.get(args.taskId);
173
174	// Check ownership
175	if (!task \|\| task.userId !== identity.token

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

convex-security-check

106installs31forks

View on GitHub

How to install convex-security-check?

waynesutton/convexskills/convex-security-check

$npx -y skills add waynesutton/convexskills --skill convex-security-check

Installs into the current project.

Summary

Quick security audit checklist covering authentication, function exposure, argument validation, row-level access control, and environment variable handling

Files · 1

View on GitHub

SKILL.md

1	# Convex Security Check
2
3	A quick security audit checklist for Convex applications covering authentication, function exposure, argument validation, row-level access control, and environment variable handling.
4
5	## Documentation Sources
6
7	Before implementing, do not assume; fetch the latest documentation:
8
9	- Primary: https://docs.convex.dev/auth
10	- Production Security: https://docs.convex.dev/production
11	- Functions Auth: https://docs.convex.dev/auth/functions-auth
12	- For broader context: https://docs.convex.dev/llms.txt
13
14	## Instructions
15
16	### Security Checklist
17
18	Use this checklist to quickly audit your Convex application's security:
19
20	#### 1. Authentication
21
22	- [ ] Authentication provider configured (Clerk, Auth0, etc.)
23	- [ ] All sensitive queries check `ctx.auth.getUserIdentity()`
24	- [ ] Unauthenticated access explicitly allowed where intended
25	- [ ] Session tokens properly validated
26
27	#### 2. Function Exposure
28
29	- [ ] Public functions (`query`, `mutation`, `action`) reviewed
30	- [ ] Internal functions use `internalQuery`, `internalMutation`, `internalAction`
31	- [ ] No sensitive operations exposed as public functions
32	- [ ] HTTP actions validate origin/authentication
33
34	#### 3. Argument Validation
35
36	- [ ] All functions have explicit `args` validators
37	- [ ] All functions have explicit `returns` validators
38	- [ ] No `v.any()` used for sensitive data
39	- [ ] ID validators use correct table names
40
41	#### 4. Row-Level Access Control
42
43	- [ ] Users can only access their own data
44	- [ ] Admin functions check user roles
45	- [ ] Shared resources have proper access checks
46	- [ ] Deletion functions verify ownership
47
48	#### 5. Environment Variables
49
50	- [ ] API keys stored in environment variables
51	- [ ] No secrets in code or schema
52	- [ ] Different keys for dev/prod environments
53	- [ ] Environment variables accessed only in actions
54
55	### Authentication Check
56
57	```typescript
58	// convex/auth.ts
59	import { query, mutation } from "./_generated/server";
60	import { v } from "convex/values";
61	import { ConvexError } from "convex/values";
62
63	// Helper to require authentication
64	async function requireAuth(ctx: QueryCtx \| MutationCtx) {
65	const identity = await ctx.auth.getUserIdentity();
66	if (!identity) {
67	throw new ConvexError("Authentication required");
68	}
69	return identity;
70	}
71
72	// Secure query pattern
73	export const getMyProfile = query({
74	args: {},
75	returns: v.union(v.object({
76	_id: v.id("users"),
77	name: v.string(),
78	email: v.string(),
79	}), v.null()),
80	handler: async (ctx) => {
81	const identity = await requireAuth(ctx);
82
83	return await ctx.db
84	.query("users")
85	.withIndex("by_tokenIdentifier", (q) =>
86	q.eq("tokenIdentifier", identity.tokenIdentifier)
87	)
88	.unique();
89	},
90	});
91	```
92
93	### Function Exposure Check
94
95	```typescript
96	// PUBLIC - Exposed to clients (review carefully!)
97	export const listPublicPosts = query({
98	args: {},
99	returns: v.array(v.object({ /* ... */ })),
100	handler: async (ctx) => {
101	// Anyone can call this - intentionally public
102	return await ctx.db
103	.query("posts")
104	.withIndex("by_public", (q) => q.eq("isPublic", true))
105	.collect();
106	},
107	});
108
109	// INTERNAL - Only callable from other Convex functions
110	export const _updateUserCredits = internalMutation({
111	args: { userId: v.id("users"), amount: v.number() },
112	returns: v.null(),
113	handler: async (ctx, args) => {
114	// This cannot be called directly from clients
115	await ctx.db.patch(args.userId, {
116	credits: args.amount,
117	});
118	return null;
119	},
120	});
121	```
122
123	### Argument Validation Check
124
125	```typescript
126	// GOOD: Strict validation
127	export const createPost = mutation({
128	args: {
129	title: v.string(),
130	content: v.string(),
131	category: v.union(
132	v.literal("tech"),
133	v.literal("news"),
134	v.literal("other")
135	),
136	},
137	returns: v.id("posts"),
138	handler: async (ctx, args) => {
139	const identity = await requireAuth(ctx);
140	return await ctx.db.insert("posts", {
141	...args,
142	authorId: identity.tokenIdentifier,
143	});
144	},
145	});
146
147	// BAD: Weak validation
148	export const createPostUnsafe = mutation({
149	args: {
150	data: v.any(), // DANGEROUS: Allows any data
151	},
152	returns: v.id("posts"),
153	handler: async (ctx, args) => {
154	return await ctx.db.insert("posts", args.data);
155	},
156	});
157	```
158
159	### Row-Level Access Control Check
160
161	```typescript
162	// Verify ownership before update
163	export const updateTask = mutation({
164	args: {
165	taskId: v.id("tasks"),
166	title: v.string(),
167	},
168	returns: v.null(),
169	handler: async (ctx, args) => {
170	const identity = await requireAuth(ctx);
171
172	const task = await ctx.db.get(args.taskId);
173
174	// Check ownership
175	if (!task \|\| task.userId !== identity.token

People who liked this also viewed

6 picks

Type