Firebase Firestore Security Audit — Find Open Rules Free

Audits Firebase Firestore & Storage security rules for the misconfigurations that leak user data to anyone with your project ID — if true catch-alls, expired test-mode, and auth-without-ownership patterns — and returns a paste-ready fix for each. For Firebase developers shipping apps whose project ID is public the moment the frontend deploys. Pricing: $0.02 per run + $0.005 per finding. A clean ruleset costs 2 cents.

The problem in one line

Your Firebase project ID is bundled in firebase-config.js — it ships to every browser. From that point, the only wall between a stranger's curl and your users' documents is your firestore.rules. This auditor checks that wall for the seven ways it commonly falls down.

Seven patterns it catches

Severity	Pattern	Why it's dangerous
🚨 CRITICAL	match /{document=**} { allow read, write: if true; }	The classic catch-all — everything is public
🚨 CRITICAL	Bare if true on any match block	Same, scoped
⚠️ HIGH	if request.auth != null with no ownership check	Any logged-in user reads every user's data
⚠️ HIGH	Test-mode timestamp.date(2099, …) rules	Wide open until the future date
⚠️ HIGH	Open read on Storage user uploads	Files publicly downloadable
⚠️ MEDIUM	Catch-all read open, write closed	Fine for a catalog, fatal for /payments
💡 INFO	Missing explicit default-deny	No safety net under your rules

Each finding ships with a fix snippet you drop straight into firestore.rules.

Two ways to audit (use either or both)

{
  "projectId": "your-firebase-project-id",
  "rulesContent": "rules_version = '2';\nservice cloud.firestore { ... }",
  "activeProbe": true,
  "outputFormat": "html-report"
}

• rulesContent — paste your firestore.rules for static analysis (finds the dangerous patterns above).
• projectId + activeProbe — sends an anonymous GET to your Firestore REST endpoint to confirm live what's actually leaking, upgrading a static warning to a proven exposure.
• Provide both for the complete picture, or neither to run a DEMO against a known-bad fixture and see the report format.

Output

• REPORT in the Key-Value Store — a self-contained HTML page: letter grade (A+ to F), severity charts, per-finding fix snippets with copy buttons, and an "apply all fixes" bundle. Open in any browser, forward to your team.
• Dataset rows — one structured finding each, for your own pipeline.

[CRITICAL] Wide-open catch-all rule
Target: match /{document=**}
★ CONFIRMED LEAK — anonymous Firestore REST returned 47 documents (12,453 bytes)

Fix (paste into firestore.rules):
match /{document=**} { allow read, write: if false; }
match /users/{uid} {
  allow read, write: if request.auth != null && request.auth.uid == uid;
}

Ethical use

Audit only projects you own or are authorized to test. Static analysis touches nothing; the active probe issues the same anonymous read a stranger with your public project ID could already make, and records only counts/paths — never the document contents at scale.

FAQ

How do I know if my Firestore rules are actually open? Paste your firestore.rules for static analysis, and/or supply your projectId with activeProbe on to confirm live whether an anonymous read succeeds. A CONFIRMED LEAK finding means a stranger really can read that path right now.

Is running the active probe against my own project risky? No — it's a read-only anonymous GET, exactly what your public project ID already permits to the world. It doesn't write, delete, or exfiltrate data en masse; it confirms exposure so you can close it.

What's the difference between static analysis and the active probe? Static analysis reads your rules text and flags dangerous patterns even before deploy. The active probe tests the deployed reality. Static can warn "this looks open"; the probe proves "this is open."

Does request.auth != null make my app secure? No — that's one of the HIGH findings. It only checks someone is logged in, not that they own the record, so any authenticated user can read everyone's data. You need an ownership check (request.auth.uid == uid).

What does a run cost? $0.02 per run plus $0.005 per finding. A ruleset with a proper default-deny and ownership checks returns few or no findings.

Can I try it without exposing my project? Yes — run with both inputs empty for a demo against a sample bad ruleset.

Is there a free or local option? Yes — a free in-browser scanner (no install): https://perufitlife.github.io/firebase-security-skill/scan.html, plus the MIT-licensed CLI and MCP server for Claude Code / Cursor. A $99 full audit (every match block, 30-day Q&A, paste-ready bundle) is offered via the report's CTA.

Sister auditors

Same family for other backends: Supabase, WordPress, PocketBase, Hasura, Nhost, Strapi, Directus, Payload, Convex.