Quick security audit checklist covering authentication, function exposure, argument validation, row-level access control, and environment variable handling

Convex Security Check A quick security audit checklist for Convex applications covering authentication, function exposure, argument validation, row level access control, and environment variable handling. Documentation Sources Before implementing, do not assume; fetch the latest documentation: Primary: https://docs.convex.dev/auth Production Security: https://docs.convex.dev/production Functions Auth: https://docs.convex.dev/auth/functions auth For broader context: https://docs.convex.dev/llms.txt Instructions Security Checklist Use this checklist to quickly audit your Convex application's security: 1. Authentication [ ] Authentication provider configured (Clerk, Auth0, etc.) [ ] All sensitive queries check ctx.auth.getUserIdentity() [ ] Unauthenticated access explicitly allowed where intended [ ] Session tokens properly validated 2. Function Exposure [ ] Public functions ( query , mutation , action ) reviewed [ ] Internal functions use internalQuery , internalMutation , internalAction [ ] No sensitive operations exposed as public functions [ ] HTTP actions validate origin/authentication 3. Argument Validation [ ] All functions have explicit args validators [ ] All functions have explicit returns validators [ ] No v.any() used for sensitive data [ ] ID validators use correct table names 4. Row Level Access Control [ ] Users can only access their own data [ ] Admin functions check user roles [ ] Shared resources have proper access checks [ ] Deletion functions verify ownership 5. Environment Variables [ ] API keys stored in environment variables [ ] No secrets in code or schema [ ] Different keys for dev/prod environments [ ] Environment variables accessed only in actions Authentication Check Function Exposure Check Argument Validation Check Row Level Access Control Check Environment Variables Check Examples Complete Security Pattern Best Practices Never run npx convex deploy unless explicitly instructed Never run any git commands unless explicitly instructed Always verify user identity before returning sensitive data Use internal functions for sensitive operations Validate all arguments with strict validators Check ownership before update/delete operations Store API keys in environment variables Review all public functions for security implications Common Pitfalls 1. Missing authentication checks Always verify identity 2. Exposing internal operations Use internalMutation/Query 3. Trusting client provided IDs Verify ownership 4. Using v.any() for arguments Use specific validators 5. Hardcoding secrets Use environment variables References Convex Documentation: https://docs.convex.dev/ Convex LLMs.txt: https://docs.convex.dev/llms.txt Authentication: https://docs.convex.dev/auth Production Security: https://docs.convex.dev/production Functions Auth: https://docs.convex.dev/auth/functions auth

convex-security-check