Deep security review patterns for authorization logic, data access boundaries, action isolation, rate limiting, and protecting sensitive operations

Convex Security Audit Comprehensive security review patterns for Convex applications including authorization logic, data access boundaries, action isolation, rate limiting, and protecting sensitive operations. Documentation Sources Before implementing, do not assume; fetch the latest documentation: Primary: https://docs.convex.dev/auth/functions auth Production Security: https://docs.convex.dev/production For broader context: https://docs.convex.dev/llms.txt Instructions Security Audit Areas 1. Authorization Logic Who can do what 2. Data Access Boundaries What data users can see 3. Action Isolation Protecting external API calls 4. Rate Limiting Preventing abuse 5. Sensitive Operations Protecting critical functions Authorization Logic Audit Role Based Access Control (RBAC) Data Access Boundaries Audit Action Isolation Audit Rate Limiting Audit Sensitive Operations Protection Examples Complete Audit Trail System Best Practices Never run npx convex deploy unless explicitly instructed Never run any git commands unless explicitly instructed Implement defense in depth (multiple security layers) Log all sensitive operations for audit trails Use confirmation codes for destructive actions Rate limit all user facing endpoints Never expose internal API keys or errors Review access patterns regularly Common Pitfalls 1. Single point of failure Implement multiple auth checks 2. Missing audit logs Log all sensitive operations 3. Trusting client data Always validate server side 4. Exposing error details Sanitize error messages 5. No rate limiting Always implement rate limits References Convex Documentation: https://docs.convex.dev/ Convex LLMs.txt: https://docs.convex.dev/llms.txt Functions Auth: https://docs.convex.dev/auth/functions auth Production Security: https://docs.convex.dev/production

convex-security-audit