convex-security-audit

Implement RBAC in Convex by creating a getUser helper that resolves the identity via ctx.auth.getUserIdentity, then a requireRole function that compares the user's role against a hierarchy and throws a ConvexError when the level is insufficient.

Filter every query by the authenticated user's ID using an index such as by_user, and verify ownership before returning sensitive items. Return null instead of an error for unauthorized items so existence is not revealed.

No, payment processing should use internalAction so it is never exposed to clients. Keep the Stripe secret key in environment variables and invoke the internal action only from trusted server-side mutations or schedulers.

Record each request in a rateLimits table with userId, action, and timestamp, then count entries within the time window before executing the mutation. Throw a ConvexError with a retryAfter value when the limit is exceeded.

Common mistakes include relying on a single auth check, skipping audit logs for sensitive operations, trusting client-supplied data without server-side validation, exposing external API error details, and shipping endpoints without rate limits.