convex

Set up a project with two deployments, dev (break anything) and prod (real users), and never point local dev at prod data:

npx convex login                 # the user approves in the browser, or run the setup-convex skill
npx convex dev --once            # creates the project + dev deployment, writes .env.local
npx convex env set KEY value     # server secrets (dev); add --prod for production
npx convex deploy                # production deploy

Write every function so it is safe and cheap:

• Every public query, mutation and action is callable by anyone who has the deployment URL. Check the user (ctx.auth or the Better Auth helper) and ownership inside each one; use internalQuery/internalMutation for anything only the server calls.
• Validate every argument with v.* validators.
• Read with .withIndex(...) on a selective index, never .filter on a large table. Define the index in schema.ts for each access pattern (by_userId, by_courseId_order, ...).
• Bound reads: .take(n) or .paginate() before enriching rows; never .collect() a table that grows.
• Return only the fields the client needs.
• Secrets live in Convex env vars, never in client code.

To optimize, start from live evidence: