name: convex-security-check description: Ten minute security pass over a Convex backend: public functions that should be internal, missing auth checks, unvalidated args, IDs from the client trusted without ownership checks, secrets in code. Use before merging a pull request, after adding new public functions, or when the user says 'quick security check'.

Convex security check

A ten minute pass over convex/ that catches the mistakes that ship most often. The one rule: every exported query, mutation, and action is a public endpoint anyone can call with any arguments, so each one must check identity and ownership or be intentionally anonymous.

Run each grep, read what it surfaces, fix or file. This skill finds problems; it does not map the whole system. For that, hand off to convex-security-audit.

When to reach for this

• Before merging a pull request that touches convex/
• After adding or renaming public functions
• The user says "quick security check", "sanity check the backend", or "anything obviously wrong here"
• Before a dev to prod push, when there is no time for a full audit

Checklist