convex-security-audit

Review five areas: authorization logic with role checks, data access boundaries with ownership filtering, action isolation for external API calls, rate limiting on user-facing mutations, and protection of sensitive operations with confirmation codes and audit logs.

Create a getUser helper that resolves the identity via ctx.auth.getUserIdentity, then use requireRole with a role hierarchy or requirePermission with per-role permission lists. Throw ConvexError with UNAUTHENTICATED or FORBIDDEN codes when checks fail.

Payment processing must use internalAction so it is never exposed to clients. Keep secret keys like Stripe credentials in environment variables, and trigger the internal action only from server-side mutations or schedulers.

Store request timestamps in a rateLimits table indexed by user and action, count requests within the time window, and reject with a RATE_LIMITED ConvexError including retryAfter when the threshold is exceeded.

Returning null avoids revealing whether a resource exists, preventing enumeration attacks. Verify ownership or shared access records before returning sensitive documents, and only expose public-visibility content to unauthenticated users.