---
changelog:
  category: Release
  version: 2.0.5
date: '2026-09-10T14:46:13Z'
seo:
  description: >-
    Hardened examples/oauth Convex wrappers to enforce caller identity and
    organization membership before listing, creating, revoking, or rotating
    organizations…
title: convex-auth v2.0.5
type: changelog
---
## What's Changed
- Hardened `examples/oauth` Convex wrappers to enforce caller identity and organization membership before listing, creating, revoking, or rotating organizations, sessions, API keys, service principals, webhooks, and audit events.
- Added `examples/oauth/convex/authz.ts` helpers (`requireCaller`, `requireMatchingUserId`, `requireOrganizationMembership`).
- Added repository security scanning and CI:
  - `pnpm run scan:security` (deps, secrets, SAST, leaks)
  - `.github/workflows/security-audit.yml`
  - Semgrep, TruffleHog, Secretlint integration
  - `pnpm-audit-exceptions` for unfixable `image-size` transitive advisories
- Bumped `convex-auth` to 2.0.5.

## Verification
- `pnpm run check` ✅
- `pnpm run typecheck` ✅
- `pnpm run build` ✅
- `pnpm test` (1275 tests) ✅
- `pnpm run scan:security` ✅
- Live Browser-Use IDOR probes against `perfect-dragon-698` rejected cross-user / cross-organization access.