convex-security-audit

Comprehensive security review patterns for Convex applications including authorization logic, data access boundaries, action isolation, rate limiting, and protecting sensitive operations. Before implementing, do not assume; fetch the latest documentation: - Primary: - Production Security: - For broader context: - Authorization Logic - Who can do what - Data Access Boundaries - What data users can see - Action Isolation - Protecting external API calls - Rate Limiting - Preventing abuse - Sensitive Operations - Protecting critical functions - Never run npx convex deploy unless explicitly instructed - Never run any git commands unless explicitly instructed - Implement defense in depth (multiple security layers) - Log all sensitive operations for audit trails - Use confirmation codes for destructive actions - Rate limit all user-facing endpoints - Never expose internal API keys or errors - Review access patterns regularly - Single point of failure - Implement multiple auth checks - Missing audit logs - Log all sensitive operations - Trusting client data - Always validate server-side - Exposing error details - Sanitize error messages - No rate limiting - Always implement rate limits - Convex Documentation: - Convex LLMs.txt: - Functions Auth: - Production Security: