Convex Code Review

Security Checklist

1. Argument AND Return Validators

• All public query, mutation, action have args validators
• All functions have returns validators
• No v.any() for sensitive data
• HTTP actions validate request body (Zod recommended)

Search: query({, mutation({, action({ - check each has args: AND returns:

2. Error Handling

• Uses ConvexError for user-facing errors (not plain Error)
• Error codes are structured: { code: "NOT_FOUND", message: "..." }
• No sensitive info leaked in error messages

Search: throw new Error should be throw new ConvexError