Firebase

Firebase apps talk to the database straight from the browser, so your security rules are the only thing standing between the internet and your data. This page explains what LetMeCheck looks at and what you should check yourself.

What a website check does#

A website check can't read your Firebase rules, but it can see what your site gives away:

• It spots that you use Firebase and reminds you to review your Firestore, Realtime Database and Storage security rules. This is advice and doesn't change your score.
• It looks for Firebase Admin credentials (a service account private key) in the code your site sends to the browser. Anyone who finds one has full control of your project, so it's a critical problem.
• It doesn't flag your Firebase web API key. That key is meant to be public, so having it in your site is normal.

What a full check adds#

A full check reads your code through read-only GitHub access. It can look for open database rules and keys in your code that a website check can't see. See Quick check vs full check.

Check your Firebase project yourself#

1. 1Open your rules. In the Firebase console, go to Firestore Database, Realtime Database or Storage and open the Rules tab.
2. 2Look for open rules. Rules like allow read, write: if true let everyone in. Rules that only check a date are "test mode" and are open until that date.
3. 3Require a login and an owner. Rules should check request.auth != null and that the signed-in user owns the data they touch. See Firebase security rules.
4. 4Test it. Use the Rules Playground to try a request from a signed-out user. It should be refused.
5. 5Check Storage too. Storage has its own rules. Make sure folders holding private files aren't open to everyone.

Fix it with your AI tool#

Open the issue in your report, click Copy fix prompt and paste it into your AI tool. See Use fix prompts. After the change, run the check again.

Related#

• Firebase security rules
• Public storage bucket
• Row level security