Convex

Trace connects to Convex through Convex's OAuth application flow. You authorize Trace on one Convex project, and Trace records every deployment in that project along with the URLs each one serves.

Why connect Convex

Your repository shows what your Convex functions do. It does not show which deployments are live right now, what their real URLs are, or whether a deployment has drifted from the code in main. Dev and preview deployments are the ones teams forget: they are real, internet-reachable backends, and they are usually the least reviewed.

There is a specific reason this matters on Convex. Every exported function that is not marked internal is a public HTTP endpoint on every deployment, and authentication on those endpoints is optional. Convex's own documentation puts it plainly: public functions "may be called by malicious users in ways that cause surprising results." Connecting Convex lets Trace enumerate exactly which functions are public, on which deployment, before a test starts.

How it works

1. From Settings → Integrations → Convex, choose Connect project. Trace sends you to Convex's authorization screen.
2. Approve Trace for the project you want covered. Convex authorizes one project per grant.
3. Trace records the project's deployments, then stores one Convex deploy key per deployment.
4. The integration page lists each deployment: its type, its .convex.cloud and .convex.site URLs, and whether Trace's access is working.

Deployments are recorded at the moment you authorize. A deployment created later does not appear until you connect the project again.

What Trace reads

During a pentest, Trace reads your deployment's system metadata:

• every function, and whether it is public or internal
• each function's type (query, mutation, action) and its argument validators
• HTTP action routes
• scheduled (cron) function definitions

Trace does not read your application data through this integration. It reads the function surface, then tests your public functions the way an unauthenticated attacker would: with plain HTTP requests carrying no credential at all. An authenticated request made with a privileged key proves nothing about whether an endpoint is exploitable; an unauthenticated one reproduces exactly what someone on the internet can do.

About the credential

Convex does not offer a read-only credential to an authorized application. We checked this against the Convex API directly: requesting a scoped key from an OAuth application is rejected, and the project token itself is read/write. So the key Trace stores is a full-access deploy key. Used directly, it could read data or deploy code.

Read-only is therefore a boundary Trace enforces in code, rather than one Convex can enforce for us. Three things make it a structural guarantee rather than a policy:

• The key never leaves Trace's API. It is not present in the pentest sandbox, so the agent cannot read it.
• The agent gets one Convex read through that API: the list of functions a connected deployment exposes, with their visibility and argument types. No mutation, action, deploy, or data read is available to it.
• Every call Trace makes with the key is logged.

Two limits on the key are worth stating because they are not obvious. The key cannot reach your project's control plane: it cannot list, create, or modify deployments, or change project settings. And the key is scoped to the project you authorized, so it gives Trace nothing in your other Convex projects.

Disconnecting, and revoking

Disconnecting a deployment or a project in Trace deletes Trace's stored copy of the key and stops Trace from using it.

Convex exposes no way for Trace to delete a key it minted, so disconnecting is not the same as revoking. To revoke, remove the Trace application under Team Settings → Applications in your Convex dashboard. That invalidates every key Trace holds for your project, and it takes effect immediately.

Permissions Trace requests

Trace requests project-level authorization. That is the narrowest grant Convex's OAuth flow offers; there is no scope parameter to reduce it further. Team-level information is not reachable with a project authorization, so Trace cannot read your members, roles, invitations, or team audit log.