convex-security-check

Convex Security Check

A quick security audit checklist for Convex applications covering authentication, function exposure, argument validation, row-level access control, and environment variable handling.

Documentation Sources

Before implementing, do not assume; fetch the latest documentation:

• Primary: https://docs.convex.dev/auth
• Production Security: https://docs.convex.dev/production
• Functions Auth: https://docs.convex.dev/auth/functions-auth
• For broader context: https://docs.convex.dev/llms.txt

Instructions

Security Checklist

Use this checklist to quickly audit your Convex application's security:

1. Authentication

• Authentication provider configured (Clerk, Auth0, etc.)
• All sensitive queries check ctx.auth.getUserIdentity()
• Unauthenticated access explicitly allowed where intended
• Session tokens properly validated

2. Function Exposure

• Public functions (query, mutation, action) reviewed
• Internal functions use internalQuery, internalMutation, internalAction
• No sensitive operations exposed as public functions
• HTTP actions validate origin/authentication

3. Argument Validation

• All functions have explicit args validators
• All functions have explicit returns validators
• No v.any() used for sensitive data
• ID validators use correct table names

4. Row-Level Access Control

• Users can only access their own data
• Admin functions check user roles
• Shared resources have proper access checks
• Deletion functions verify ownership

5. Environment Variables

• API keys stored in environment variables
• No secrets in code or schema
• Different keys for dev/prod environments
• Environment variables accessed only in actions

Authentication Check

// convex/auth.ts
import { query, mutation } from "./_generated/server";
import { v } from "convex/values";
import { ConvexError } from "convex/values";
 
// Helper to require authentication
async function requireAuth(ctx: QueryCtx |

Function Exposure Check

// PUBLIC - Exposed to clients (review carefully!)
export const listPublicPosts = query({
  args: {},
  returns: v.array(v.object({ /* ... */ })),
  handler: async (ctx) => {
    // Anyone can call this - intentionally public
    return await ctx.db

Argument Validation Check

// GOOD: Strict validation
export const createPost = mutation({
  args: {
    title: v.string(),
    content: v.string(),
    category: v.union(
      v.literal("tech"),
      v.literal("news"),

Row-Level Access Control Check

// Verify ownership before update
export const updateTask = mutation({
  args: {
    taskId: v.id("tasks"),
    title: v.string(),
  },
  returns: v.null(),
  handler: async

Environment Variables Check

// convex/actions.ts
"use node";
 
import { action } from "./_generated/server";
import { v } from "convex/values";
 
export const sendEmail = action({
  args: {
    to: v.string(),

Examples

Complete Security Pattern

// convex/secure.ts
import { query, mutation, internalMutation } from "./_generated/server";
import { v } 

Best Practices

• Never run npx convex deploy unless explicitly instructed
• Never run any git commands unless explicitly instructed
• Always verify user identity before returning sensitive data
• Use internal functions for sensitive operations
• Validate all arguments with strict validators
• Check ownership before update/delete operations
• Store API keys in environment variables
• Review all public functions for security implications

Common Pitfalls

1. Missing authentication checks - Always verify identity
2. Exposing internal operations - Use internalMutation/Query
3. Trusting client-provided IDs - Verify ownership
4. Using v.any() for arguments - Use specific validators
5. Hardcoding secrets - Use environment variables

References

• Convex Documentation: https://docs.convex.dev/
• Convex LLMs.txt: https://docs.convex.dev/llms.txt
• Authentication: https://docs.convex.dev/auth
• Production Security: https://docs.convex.dev/production
• Functions Auth: https://docs.convex.dev/auth/functions-auth