# Do your Convex functions return data to anyone who calls them?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

This Deep scan check calls Convex query functions your site code uses, with no sign-in and no arguments, and flags any that return data.

This check calls Convex query functions your site code already uses, with no sign-in and no arguments, and flags any that return data. Only queries are called, never mutations or actions.

## What does this check look at?

It looks at whether a Convex query function your site code calls returns data to a call with no sign-in. Convex says that by default your Convex functions are public and accessible to clients.

Only a Deep scan runs it, after you prove you own the site. It applies only when the site code talks to Convex.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| High or medium finding | A query returned data with no sign-in. | Check identity in the function, or make it internal. |

Only queries are called, never mutations or actions, so it does not show that data can be changed. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

Fix this first when it is confirmed. Anyone could use a finding of this kind on their own, with no victim and no second step. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label.

### What does a confirmed finding have to show?

| Part | For this check |
| --- | --- |
| Where it starts | Anyone on the internet, with no account, cookie or credential |
| The protection that should stop it | The query function did not require authentication |
| What is reached | The function returned records |
| What follows | What the returned records hold |

## Which standards does it relate to?

No OWASP, CWE or ASVS reference fits this check closely enough to state, so the report and this page leave it unmapped.

## Fix it with your AI

Add an identity check at the top of the function, or move logic the client never calls into internal functions.

:::fix-prompt any
This Convex query returns data without sign-in: [paste the function from the report]. Add an authentication check at the start of the handler using ctx.auth.getUserIdentity(), throw when it is null, and filter results to records the signed-in user owns. If the client never calls this function, convert it to an internalQuery. Show me the change and how to confirm an anonymous call now fails.
:::

## How to check

Say Atlas, our example app at `atlas.example`, lists orders with a query that never checks the caller. A Deep scan calls it with no arguments, gets records back and keeps only counts.

Deep scans come with the Deep plan, and [pricing](/pricing) shows what it includes. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### Are public Convex functions a mistake?

Not always. Some data is meant for everyone. The finding asks you to confirm that this function is one of them.

### Did the scan change any data?

No. It only calls query functions, which cannot write, and sends no arguments.

## Sources

- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07
- [Internal Functions](https://docs.convex.dev/functions/internal-functions), Convex docs, read on 2026-10-07