convex
Expert in Convex for schema design, TypeScript functions, real-time subscriptions, and deployment in modern web applications.
Install this skill
Security score
The convex skill was audited on Feb 28, 2026 and we found 26 security issues across 4 threat categories, including 2 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 311 | Authorization: `Bearer ${process.env.SENDGRID_API_KEY}`, |
Template literal with variable interpolation in command context
| 340 | Authorization: `Bearer ${process.env.OPENAI_API_KEY}`, |
Fetch to external URL
| 308 | const response = await fetch("https://api.sendgrid.com/v3/mail/send", { |
Fetch to external URL
| 337 | const response = await fetch("https://api.openai.com/v1/embeddings", { |
Webhook reference - potential data exfiltration
| 41 | | **HTTP Action** | Webhooks/custom endpoints | via `runQuery` | via `runMutation` | ✅ | ❌ | |
Webhook reference - potential data exfiltration
| 358 | ### HTTP Actions (Webhooks) |
Webhook reference - potential data exfiltration
| 368 | path: "/webhooks/stripe", |
Webhook reference - potential data exfiltration
| 374 | // Verify webhook signature here... |
Webhook reference - potential data exfiltration
| 377 | await ctx.runMutation(api.payments.handleWebhook, { event }); |
Webhook reference - potential data exfiltration
| 790 | - `@stripe` — Payment integration via Convex actions and HTTP webhooks |
Access to .env file
| 66 | 5. Creates `.env.local` with `CONVEX_DEPLOYMENT` and `NEXT_PUBLIC_CONVEX_URL` |
Access to .env file
| 80 | ├── .env.local ← CONVEX_DEPLOYMENT, NEXT_PUBLIC_CONVEX_URL |
Access to .env file
| 311 | Authorization: `Bearer ${process.env.SENDGRID_API_KEY}`, |
Access to .env file
| 340 | Authorization: `Bearer ${process.env.OPENAI_API_KEY}`, |
Access to .env file
| 396 | const convex = new ConvexReactClient(process.env.NEXT_PUBLIC_CONVEX_URL!); |
Access to .env file
| 494 | const convex = new ConvexReactClient(process.env.NEXT_PUBLIC_CONVEX_URL!); |
Access to .env file
| 526 | const convex = new ConvexReactClient(process.env.NEXT_PUBLIC_CONVEX_URL!); |
Access to .env file
| 530 | <ClerkProvider publishableKey={process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY!}> |
Access to .env file
| 704 | const apiKey = process.env.OPENAI_API_KEY; |
Access to .env file
| 763 | - **Problem:** "`process.env` is undefined in query/mutation" |
External URL reference
| 308 | const response = await fetch("https://api.sendgrid.com/v3/mail/send", { |
External URL reference
| 337 | const response = await fetch("https://api.openai.com/v1/embeddings", { |
External URL reference
| 546 | npx convex env set SITE_URL http://localhost:3000 |
External URL reference
| 795 | - [Convex Stack (Blog)](https://stack.convex.dev) |
External URL reference
| 797 | - [Discord Community](https://convex.dev/community) |
External URL reference
| 798 | - [Convex Chef (AI Starter)](https://chef.convex.dev) |