What problem does it solve? Convex backends often ship with exploitable authorization gaps: identity taken from client-supplied arguments, missing per-document ownership checks, PII-leaking public queries, and writes into containers the caller does not own. This Skill finds and fixes those four defect shapes before they reach production. ## Core Features & Use Cases - Deterministic Four-Shape Scan: Regex-based detection of identity-from-arg impersonation, missing ownership checks, PII-leaking queries, and parent-reference write violations across all convex/**/*.ts files. - Canonical Hardening: Applies the requireIdentity/requireOwner pattern from convex-expert.md to every hit, including subject-keyed users-table resolution and membership checks for container writes. - Foundation Gate: Verifies auth.config.ts and a subject-keyed users table exist before injecting ctx.auth enforcement; on foundationless apps it converts privileged functions to internalQuery/internalMutation instead. - Use Case: Before launching a Convex app, run the audit to find that a public mutation accepts userId as an argument, letting any caller impersonate another user, then automatically rewrite it to derive identity from ctx.auth and verify with tsc. ## Quick Start Audit my Convex backend for authorization vulnerabilities and harden any public queries and mutations that leak data or skip ownership checks.
