Implementation recipes
These are not feature bullets. They are the guides that ship inside the product, on the Implement tab of each module. Each one carries a goal, prerequisites, the full file inventory, ordered steps with real code, verification at every stage, and a definition of done. Below is what each one covers.
Showing 13 of 173 recipes.
Product analytics that never ship raw personal data or secrets. Events are typed, redacted before they leave the app, and blocked when a user declines consent, while operators keep a readable local event stream for support. PostHog is optional — everything works in debug mode without it.
redaction before events leave the app
Event names drift the moment two people add tracking. A shared typed catalog gives every event one agreed name, makes unknown names fail fast in development, keeps redaction on every payload, and leaves product and marketing a documented list of what fires when and with which properties.
undeclared events landing in production
Bring your SQL instincts to Convex. A status UNION or a parent-child join becomes a live query that stays paginated and tenant-safe instead of loading the whole set to sort in memory, and you finish knowing which SQL clause each piece of the query replaces.
pagination without collect-then-sort
Feeds that read from several ranges at once, merged into one correctly ordered, paginated stream. Covers the pitfalls that quietly break cursors under real load — mismatched merge order, filters doing access control, and page boundaries drifting as data changes underneath — so the feed holds up in production.
cursor drift across merged ranges
Private project attachments on Convex File Storage, with no public bucket and no second vendor to set up. Every upload and download is permission-checked, download links expire on their own, and one organization can never list or fetch another's files. Members attach files to projects they can already edit.
expiring links, cross-tenant read isolation
When objects get large or need CDN reach, Cloudflare R2 takes the bytes while Convex still owns every permission check and attachment record. Uploads and downloads run through short-lived links, object keys are scoped per tenant, credentials never reach the browser, and the bucket stays fully private.
tenant-scoped keys on an S3-compatible API
For teams already on AWS, or with residency rules that name a region, this puts large objects in a private Amazon S3 bucket that still answers to Convex for every permission check and attachment record. Public access stays blocked, links are short-lived, and credentials never leave the server.
regional signing with public access blocked
Deleting a file should leave nothing behind. You get a permissioned remove action with a confirm step in the UI that clears the attachment record and the stored bytes in one transaction, so nothing lingers as an unreachable orphan and your storage bill matches what users can see.
orphaned blobs after a delete
Your billing plan promises a file allowance; this makes storage honour it. An organization at its limit gets a clear, named rejection before the upload starts — no bytes land, nothing is orphaned — and the person uploading sees an upgrade prompt instead of a raw error. Existing files stay untouched.
counting quota before the upload begins
One shared allowlist of file types and a size cap, enforced in the browser, again on the server before an upload begins, and once more at save time. Anything that slips past the first two checks is removed immediately, so a rejected upload never leaves stray bytes behind.
clients that skip the browser check
The team-logo setting, done properly. Each organization holds exactly one current image, the settings page preview updates live the moment a new logo lands, and every replaced image is deleted on the spot — so changing the logo five times never leaves four dead files in storage.
cleaning up the image you replaced
A TanStack Form create flow where the form and the backend agree on what counts as valid. Field and submit checks surface errors inline as people type, the server independently refuses anything invalid, and an accepted row clears the form and appears in the product list immediately.
validation the client cannot skip
A sortable, searchable, filterable product grid backed by live Convex data, with pagination and a seed action for demo rows. Every read is scoped on the server, so members only ever see their own organization's records, and new or edited rows appear in the grid without a refresh.
server-side scoping behind client-side sorting