Convex security check

Convex security check

A ten minute pass over convex/ that catches the mistakes that ship most often. The one rule: every exported query, mutation, and action is a public endpoint anyone can call with any arguments, so each one must check identity and ownership or be intentionally anonymous.

Run each grep, read what it surfaces, fix or file. This skill finds problems; it does not map the whole system. For that, hand off to convex-security-audit.

When to reach for this

• Before merging a pull request that touches convex/
• After adding or renaming public functions
• The user says "quick security check", "sanity check the backend", or "anything obviously wrong here"
• Before a dev to prod push, when there is no time for a full audit

Checklist

Run the commands from the project root. Every grep excludes _generated.

1. Public vs internal

Anything only called by other Convex functions, the scheduler, crons, or webhooks should be internalQuery, internalMutation, or internalAction.

rg -n "export const \w+ = (query|mutation|action)\(" convex --glob '!**/_generated/**'
rg -n "\bapi\.\w+\.\w+" convex --glob '!**/_generated/**'

The second grep finds api.* used inside the backend. Server code scheduling or running a public function is almost always a sign that function should be internal.

• Every public function has a client that needs to call it
• No api.* inside ctx.scheduler.*, ctx.run*, or crons.*
• Admin only operations (role changes, credit grants, deletions across users) are internal

2. Auth

rg -l "= (query|mutation|action)\(" convex --glob '!**/_generated/**' \
  | xargs rg -L "getUserIdentity|getCurrentUser|authedQuery|authedMutation"

Files listed contain public functions and no auth call at all. Open each one. A public post list is fine anonymous. Anything that returns or writes user data is not.