convex-reviewer

Run a structured review that verifies every public function calls ctx.auth.getUserIdentity(), checks resource ownership before reads and writes, and never trusts client-provided user IDs. Missing auth checks on public mutations are flagged as Critical since they risk data loss.

The main anti-patterns are using .filter() on database queries (a full table scan requiring withIndex instead), missing indexes on foreign-key fields, calling Date.now() in query handlers which breaks reactivity, and using .collect() on unbounded queries.

Scheduled functions should target internal.* functions rather than api.* because public API functions are exposed to clients. Scheduling to api.* endpoints creates an attack surface, so the review flags this pattern as Important.

Yes, every public Convex function should define args and returns validators. Missing validators are flagged as Important findings because they weaken type safety and allow unvalidated data into your backend.

Run the review before shipping or merging changes to your convex/ directory. It produces findings grouped by severity (Critical, Important, Suggestion) with explanations of why each issue matters and a suggested fix.