Mechanically
Stores creators' third-party platform credentials. The password field is a plaintext string and the read query is public with zero identity checks in the module. The gate in front of it publicly returns its own password hash.
Real but insecure
Domain 12 · platform · ~1,500 LOC
Secure logins (credential vault)
Stores creators' third-party platform credentials. The password field is a plaintext string and the read query is public with zero identity checks in the module. The gate in front of it publicly returns its own password hash.
What it is and how it feeds the rest
How it connects
Standalone vault keyed by creator email.
Worth knowing
Highest-severity finding in the review. Assume already exposed: encrypt AND rotate.
Pages
src/pages/SecureLogins.tsx
Components
src/components/secure-logins/
Convex modules
socialMediaLogins.tssecureArea.ts
Tables
socialMediaLoginssecureAreaPasswords
Findings that touch this domain
critical Creator platform passwords stored plaintext, readable unauthenticated
convex/schema.ts:502, convex/socialMediaLogins.ts:13,20
high Vault gate publicly returns its own password hash; anyone can overwrite it
convex/secureArea.ts:6,17
critical Zero server-side authentication — ctx.auth appears 0 times in 36 modules; 221 public vs 22 internal functions
convex/*.ts
Open questions
Research priority for this domain is low. Agent findings splice in below this line and survive regeneration.