convex
Expert in Convex for schema design, TypeScript functions, real-time subscriptions, and deployment in modern web applications.
Install this skill
Security score
The convex skill was audited on May 12, 2026 and we found 26 security issues across 4 threat categories, including 2 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 310 | Authorization: `Bearer ${process.env.SENDGRID_API_KEY}`, |
Template literal with variable interpolation in command context
| 339 | Authorization: `Bearer ${process.env.OPENAI_API_KEY}`, |
Fetch to external URL
| 307 | const response = await fetch("https://api.sendgrid.com/v3/mail/send", { |
Fetch to external URL
| 336 | const response = await fetch("https://api.openai.com/v1/embeddings", { |
Webhook reference - potential data exfiltration
| 40 | | **HTTP Action** | Webhooks/custom endpoints | via `runQuery` | via `runMutation` | ✅ | ❌ | |
Webhook reference - potential data exfiltration
| 357 | ### HTTP Actions (Webhooks) |
Webhook reference - potential data exfiltration
| 367 | path: "/webhooks/stripe", |
Webhook reference - potential data exfiltration
| 373 | // Verify webhook signature here... |
Webhook reference - potential data exfiltration
| 376 | await ctx.runMutation(api.payments.handleWebhook, { event }); |
Webhook reference - potential data exfiltration
| 789 | - `@stripe` — Payment integration via Convex actions and HTTP webhooks |
Access to .env file
| 65 | 5. Creates `.env.local` with `CONVEX_DEPLOYMENT` and `NEXT_PUBLIC_CONVEX_URL` |
Access to .env file
| 79 | ├── .env.local ← CONVEX_DEPLOYMENT, NEXT_PUBLIC_CONVEX_URL |
Access to .env file
| 310 | Authorization: `Bearer ${process.env.SENDGRID_API_KEY}`, |
Access to .env file
| 339 | Authorization: `Bearer ${process.env.OPENAI_API_KEY}`, |
Access to .env file
| 395 | const convex = new ConvexReactClient(process.env.NEXT_PUBLIC_CONVEX_URL!); |
Access to .env file
| 493 | const convex = new ConvexReactClient(process.env.NEXT_PUBLIC_CONVEX_URL!); |
Access to .env file
| 525 | const convex = new ConvexReactClient(process.env.NEXT_PUBLIC_CONVEX_URL!); |
Access to .env file
| 529 | <ClerkProvider publishableKey={process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY!}> |
Access to .env file
| 703 | const apiKey = process.env.OPENAI_API_KEY; |
Access to .env file
| 762 | - **Problem:** "`process.env` is undefined in query/mutation" |
External URL reference
| 307 | const response = await fetch("https://api.sendgrid.com/v3/mail/send", { |
External URL reference
| 336 | const response = await fetch("https://api.openai.com/v1/embeddings", { |
External URL reference
| 545 | npx convex env set SITE_URL http://localhost:3000 |
External URL reference
| 794 | - [Convex Stack (Blog)](https://stack.convex.dev) |
External URL reference
| 796 | - [Discord Community](https://convex.dev/community) |
External URL reference
| 797 | - [Convex Chef (AI Starter)](https://chef.convex.dev) |