convex

No code to analyze. Without code, cannot assess for malicious behavior, credential flows, or data exfiltration patterns. The input appears to be documentation rather than an installable/ executable module. Recommend supplying the actual code files (e.g., TypeScript sources, configuration, or package manifests) for a proper security review.