Firebase Security Scanner

Firebase projects are frequently deployed with development-mode security rules that allow unrestricted read/write access. Our scanner checks Firestore and Realtime Database security rules, Firebase Authentication configuration, Cloud Storage rules, and identifies common Firebase misconfigurations that expose user data.

What This Scanner Does

Tests Firestore and Realtime Database endpoints for open read/write access, analyzes authentication provider configuration, checks Cloud Storage bucket rules, detects Firebase config exposure in client bundles, and verifies that security rules enforce proper access control.

Why It Matters

Firebase projects deployed with test-mode rules (`allow read, write: if true`) are completely open to the public internet. Attackers routinely scan for these misconfigured databases and have stolen millions of user records from production Firebase projects with no authentication required.

Common Findings

• Firestore rules allow unrestricted read/write access
• Realtime Database rules set to open (test mode)
• Cloud Storage bucket publicly writable
• Firebase config exposes project details in client code
• No email verification required for authentication
• Missing rate limiting on authentication endpoints

OWASP Top 10 Coverage

Related Security Checks