Skip to content
Get a quote

Fixed-price offerFirebase Security Rules audit, with the fixes as a pull request

Apps built quickly on Firebase often ship rules that check whether someone is signed in, not whether the data is theirs. This audit tests your Firestore and Storage rules the way an attacker would, on the emulator, and hands back a fix that passes the tests.

Pay $950 & start

Full refund if Simon can’t take it on once he sees your project, or if you cancel before work starts.

Check fit by email

$950 fixed price, 5 business days from repo access. Runs on the emulator only.

Work starts as soon as payment and the access arrive.

Price checked .

No call needed. Ask a question first by email at contact@app369.com or with the contact form; we reply by email, usually within one business day.

Short answer

The Firebase Security Rules Audit tests whether one signed-in user can read or change another customer's data in the Firestore and Storage rules of one Firebase project, then fixes what it finds. It costs $950 and takes 5 business days, with a report ranked by severity and a pull request. It fits apps built quickly on Firebase.

Firebase Security Rules Audit + Fix PR

Apps built quickly on Firebase often ship with rules that let one signed-in user read or edit another customer’s data. This audit tests whether yours does, and fixes what it finds.

$950
fixed price, 5 business days

Scope

  • Firestore and Storage rules, plus up to 15 Cloud Functions, in one Firebase project

You get

  • A written role and tenant access model
  • An emulator test suite that tries cross-user reads and writes, cross-tenant reads and writes, and role escalation
  • A report ranked by severity
  • A pull request with rule fixes that passes the suite
  • One revision round

Delivery

5 business days.

Pay $950 & start

Full refund if Simon can’t take it on once he sees your project, or if you cancel before work starts.

After you pay

Simon emails you within one business day to confirm and send the access checklist. You can also send it straight away to contact@app369.com. What the work needs:

  • Access to the repository with your Firebase rules and Cloud Functions
  • Which Firebase project it covers, and the roles your app has (for example owner, member, client)

Delivery takes 5 business days from repo access. Production is never touched.

Full refund if Simon can’t take it on once he sees your project, or if you cancel before work starts.

Your code stays private: it is never shared or reused, and Simon deletes his copy at delivery. An NDA is fine; send yours with the access.

Not sure it fits? See who it fits, or email a question about this offer; we reply by email, usually within one business day.

This fits when

  • Your rules mostly check request.auth != null
  • You added teams, workspaces or roles after launch
  • A customer, investor or security questionnaire asks how tenant data is isolated
  • You can’t say for sure what a signed-in user could read with the Firebase SDK

Errors this fixes

Each page explains the error from the vendor’s own docs, with what to try first.

How it works

  1. Pay and share the repo

    Repo access to the Firebase project’s rules and functions is all that’s needed. No production access.

  2. Write the access model

    Who should read and write each collection and Storage path, by role and tenant, written down so you can check it.

  3. Attack it on the emulator

    A test suite tries cross-user reads and writes, cross-tenant reads and writes, and role escalation against your current rules.

  4. Report and fix PR

    Findings ranked by severity, and a pull request with rule fixes that passes the suite. The suite stays in your repo for future changes.

See what gets tested

The free Firebase Security Rules checker reads your rules in your browser and flags the common mistakes. This is its real result on the example rules built into the tool. The audit goes further: it writes down who should access what, attacks your rules on the emulator, and fixes what fails.

Run the free checker on your rules

Firebase Security Rules checker result: 5 issues found, 4 serious. The first, critical on line 18, is a test-mode rule that lets anyone read and write every document until 2030-01-01.

Questions before you pay

Is this a compliance certificate?
How many Cloud Functions are covered?
Will you touch production?
Is my code kept private?
Do I need a call before I pay?
Who owns what you deliver?

Fiverr reviews / 3 hand-picked of 127

What buyers said about Simon’s development work

Read 126 of the 127 reviews
  • “Working with Simon makes everything run so smoothly and better than I could ask for it. Amazingly communicative, extremely knowledgeable of coding and the backend processes. I strongly recommend.”
    A buyer in the United States, January 2026. App development on Fiverr
  • “Working with Simon has been an absolute pleasure. He’s not only incredibly skilled with his code, but he also brought so much care and attention to detail, especially when creating a custom section template for my Shopify site. He made the entire process smooth and collaborative, and consistently went above and beyond to make sure everything looked and functioned beautifully, very much the way I've envisioned. Highly recommend him for anyone looking for thoughtful, top-notch development support!”
    A buyer in China, April 2025. Custom order on Fiverr
  • “Very responsive, attentive to fixing bugs, and completed the project as needed! Thank you!”
    A buyer in the United States, July 2022. Shopify on Fiverr

Read the whole story

Ready to start?

Pay online and send what the work needs by replying to the Stripe receipt. Simon, who builds and runs the SaaS Workspace369, does the work himself.

Pay $950 & start

Full refund if Simon can’t take it on once he sees your project, or if you cancel before work starts.

Further reading

Related fixed-price offers

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Looking for something else? See all fixed-price offers