sec-check

name: sec-check description: Security review checklist for Convex functions, auth logic, public queries, admin routes, webhooks, uploads, and AI-generated code. Use when reviewing code that touches user data, PII, or access control.

Security Review Skill

Use this skill when reviewing Convex functions, auth logic, public query shapes, admin routes, webhooks, uploads, or any AI generated code that touches user data.

When to use it

Reach for this skill when:

• a mutation writes user or admin data
• a public query returns package or user data
• an internal function should be separated from a public wrapper
• a form collects names, emails, or other contact info
• a webhook, upload, or API key flow is added
• AI generated code needs a security pass before shipping

Auth and ownership checks

• Call ctx.auth.getUserIdentity() before authenticated writes.
• Never trust client supplied user ids for ownership.
• Prefer indexed ownership checks over fetch then compare patterns.
• Use internalQuery, internalMutation, and internalAction for sensitive backend work.
• Keep public wrappers thin. Do auth and access checks there, then call internal functions.
• Return generic Not found style errors when you should not reveal existence.

Data exposure rules

• Public queries should return public safe shapes only.
• Strip PII like email, name, Discord handle, internal notes, AI review details, or admin metadata unless the caller is allowed to see them.
• Add explicit return validators on public functions so the response shape stays tight.
• Mutations should return minimal data, usually ids or null, not the submitted object.
• Treat everything returned by a query as visible in browser DevTools and WebSocket traffic.

Sensitive integrations

• Keep secrets in server side environment variables only.
• Validate webhook signatures before processing.
• Restrict CORS for sensitive endpoints.
• Validate upload types and file sizes server side.
• Do not send user PII into AI prompts when it is not required for the task.
• Use simple actor labels like AI or System, not fake email addresses, for automated actions.

AI generated code checks

• Watch for missing returns validators.
• Watch for public query or mutation usage where internal* should be used.
• Watch for ctx.db.get() plus client supplied ids in ownership checks.
• Watch for full objects returned from public queries or mutations.
• Watch for vague or over detailed error messages that leak internal state.

Verification checklist

• Open the browser network panel and inspect WebSocket or XHR responses for sensitive fields.
• Hard refresh after deploying security changes so cached subscriptions do not fool the test.
• Verify public queries exclude PII and internal metadata.
• Verify admin queries require auth and admin checks before returning full data.
• Verify mutations return minimal data.
• Verify any new action or integration logs full errors only on the server side.