Convex security audit

Convex security audit

Produces a written findings report covering every public function, every table, and every entry point (HTTP routes, file storage, scheduler). The one rule: every exported query, mutation, and action is a public endpoint anyone on the internet can call with any arguments, so each one must prove who the caller is and what they may touch.

For a ten minute pass, use convex-security-check instead. This skill is the slow, complete version.

When to reach for this

• Before a production launch or a major release
• After an incident, a leaked key, or suspicious data access
• When the codebase has grown past a handful of public functions and nobody has mapped who can call what
• When adding multi tenant, admin, or billing features
• When the user asks for "a full audit", "security review", or "check the whole backend"

Reference files

• references/authorization-patterns.md: open when fixing findings, it has the getCurrentUser helper, customQuery and customMutation wrappers for authed, admin, and tenant scoped access, ownership checks through indexes, and role checks.
• references/attack-surface.md: open during steps 4 through 7, it covers HTTP actions, storage URL leakage, scheduler trust, rate limiting with @convex-dev/rate-limiter, secrets in env, and client supplied IDs.
• references/audit-report-template.md: open at step 8, it is the findings template and the per table data access matrix to fill in.

Audit procedure

Work through the steps in order. Record every finding as you go. Do not fix anything until the inventory is complete; fixing early hides the shape of the problem.

1. Inventory public functions

List every exported query, mutation, and action. These are the attack surface.

rg -n "export const \w+ = (query|mutation|action)\(" convex --glob '!**/_generated/**'

For each one write down: file, name, type, whether a client needs to call it, and whether it is costly (sends email, calls an LLM, creates records) and so needs a rate limit. Anything only called by other Convex functions, crons, or the scheduler should be internalQuery, internalMutation, or internalAction. Flag each of those as a finding.

2. Map auth per function

For every public function from step 1, answer: does it call ctx.auth.getUserIdentity() (or a helper that does) before reading or writing? Which functions are intentionally anonymous?

rg -l "= (query|mutation|action)\(" convex --glob '!**/_generated/**' \