Skip to content
Get a quote

Firebase Security Rules checker

Paste your firestore.rules or storage.rules file to find the patterns that most often expose user data: public paths, test-mode rules, sign-in-only checks, ownership takeovers and unvalidated writes. The check runs in your browser; your rules are never uploaded.

Your rules

Want the rules tested and fixed?

This checker only reads the rules text. The Firebase Security Rules Audit writes down who should access what, attacks your rules on the emulator with cross-user, cross-tenant and role-escalation tests, and delivers a pull request with fixes that pass. $950, 5 business days, never touching production.

Pay $950 & startHow the Rules Audit works

Full refund if Simon can’t take it on once he sees your project, or if you cancel before work starts.

What the checker looks for

Public paths
Rules with if true, or no condition at all, that let anyone read or write without signing in.
Test-mode rules
The time-limited rule the Firebase console adds in test mode, whether it is still open or has expired.
Sign-in-only checks
Rules that only check request.auth != null, so any user of your app can reach every other user’s data.
Ownership takeover
Updates that check the new owner field but not the stored one, letting a user claim someone else’s document.
Catch-all wildcards
A top-level {document=**} rule that also applies to every collection added later.
Unvalidated writes
No checks on request.resource.data, so clients can set trusted fields such as role or plan.
Storage uploads
Write rules with no file size limit or content type check.
Rules version
Firestore rules without rules_version = '2'.

Questions

Are my rules sent anywhere?
No. The check runs in your browser with JavaScript, and the rules text never leaves the page. Only an anonymous count of findings is recorded for usage statistics.
If the checker finds nothing, are my rules secure?
Not necessarily. It looks for common risky patterns in the text. It can’t see your data model, your Cloud Functions or how your app queries data, so it can miss logic errors. Testing the rules on the Firebase Emulator Suite is how you confirm they behave as intended.
Why is request.auth != null not enough?
Anyone can sign up for your app, and your Firebase config ships inside it. A rule that only checks for a signed-in user lets every user read or change every other user’s documents through the Firebase SDK.
Does it check Cloud Storage rules too?
Yes. Paste a storage.rules file and it checks public paths, sign-in-only rules and missing upload size and file type limits.
Does it check Realtime Database rules?
No. Realtime Database rules use a different, JSON-based format. This tool checks Cloud Firestore and Cloud Storage rules.

Next: how to test Firebase Security Rules with the emulator and the Firebase Security Rules guide. To find Firebase products in your code that have a shutdown date, use the Firebase shutdown checker. Rules too tight instead, and the app shows an error? See the “Missing or insufficient permissions” fix. Did Firebase warn you that your database isn’t properly secured? See the insecure rules alert fix. To check the live app too, paste its address into the free AI app security check. It looks for secret keys in the app’s JavaScript and for missing security headers. Other Firebase errors: the query requires an index and auth/unauthorized-domain.

Link to this checker

Writing a Firebase tutorial, a README or a forum answer about Security Rules? You’re welcome to link here. The checker is free, needs no sign-up, and never uploads your rules.

Fixed-price Firebase help

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.