Do your Convex functions return data to anyone who calls them?
This check calls Convex query functions your site code already uses, with no sign-in and no arguments, and flags any that return data. Only queries are called, never mutations or actions.
What does this check look at?
It looks at whether a Convex query function your site code calls returns data to a call with no sign-in. Convex says that by default your Convex functions are public and accessible to clients.
Only a Deep scan runs it, after you prove you own the site. It applies only when the site code talks to Convex.
What does a result mean?
| What the report shows | What it means | What to do |
|---|---|---|
| High or medium finding | A query returned data with no sign-in. | Check identity in the function, or make it internal. |
Only queries are called, never mutations or actions, so it does not show that data can be changed. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.
How serious is a finding?
Fix this first when it is confirmed. Anyone could use a finding of this kind on their own, with no victim and no second step. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label.
What does a confirmed finding have to show?
| Part | For this check |
|---|---|
| Where it starts | Anyone on the internet, with no account, cookie or credential |
| The protection that should stop it | The query function did not require authentication |
| What is reached | The function returned records |
| What follows | What the returned records hold |
Fix it with your AI
Add an identity check at the top of the function, or move logic the client never calls into internal functions.
This Convex query returns data without sign-in: [paste the function from the report]. Add an authentication check at the start of the handler using ctx.auth.getUserIdentity(), throw when it is null, and filter results to records the signed-in user owns. If the client never calls this function, convert it to an internalQuery. Show me the change and how to confirm an anonymous call now fails.How to check
Say Atlas, our example app at atlas.example, lists orders with a query that never checks the caller. A Deep scan calls it with no arguments, gets records back and keeps only counts.
Deep scans come with the Deep plan, and pricing shows what it includes. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.
Questions people ask
Are public Convex functions a mistake?
Not always. Some data is meant for everyone. The finding asks you to confirm that this function is one of them.
Did the scan change any data?
No. It only calls query functions, which cannot write, and sends no arguments.
Run this check on your site
Only a Deep scan runs this check, once you prove you own the site. Deep walks your whole site, the scripts it loads and your API surface.
Run a Deep scanSources
- How we rate findings Lockpick docs, read on October 7, 2026
- Internal Functions Convex docs, read on October 7, 2026