Contact Us

Firebase Security Rules checker

Paste your firestore.rules or storage.rules file to find the patterns that most often expose user data: public paths, test-mode rules, sign-in-only checks, ownership takeovers and unvalidated writes. The check runs in your browser; your rules are never uploaded.

Your rules

Want the rules tested and fixed?

This checker only reads the rules text. The Firebase Security Rules Audit writes down who should access what, attacks your rules on the emulator with cross-user, cross-tenant and role-escalation tests, and delivers a pull request with fixes that pass. $950, 5 business days, never touching production.

Pay $950 & startHow the Rules Audit works

What the checker looks for

Public paths
Rules with if true, or no condition at all, that let anyone read or write without signing in.
Test-mode rules
The time-limited rule the Firebase console adds in test mode, whether it is still open or has expired.
Sign-in-only checks
Rules that only check request.auth != null, so any user of your app can reach every other user’s data.
Ownership takeover
Updates that check the new owner field but not the stored one, letting a user claim someone else’s document.
Catch-all wildcards
A top-level {document=**} rule that also applies to every collection added later.
Unvalidated writes
No checks on request.resource.data, so clients can set trusted fields such as role or plan.
Storage uploads
Write rules with no file size limit or content type check.
Rules version
Firestore rules without rules_version = '2'.

Questions

Are my rules sent anywhere?
No. The check runs in your browser with JavaScript, and the rules text never leaves the page. Only an anonymous count of findings is recorded for usage statistics.
If the checker finds nothing, are my rules secure?
Not necessarily. It looks for common risky patterns in the text. It can’t see your data model, your Cloud Functions or how your app queries data, so it can miss logic errors. Testing the rules on the Firebase Emulator Suite is how you confirm they behave as intended.
Why is request.auth != null not enough?
Anyone can sign up for your app, and your Firebase config ships inside it. A rule that only checks for a signed-in user lets every user read or change every other user’s documents through the Firebase SDK.
Does it check Cloud Storage rules too?
Yes. Paste a storage.rules file and it checks public paths, sign-in-only rules and missing upload size and file type limits.
Does it check Realtime Database rules?
No. Realtime Database rules use a different, JSON-based format. This tool checks Cloud Firestore and Cloud Storage rules.

Next: how to test Firebase Security Rules with the emulator and the Firebase Security Rules guide.

Fixed-price Firebase help

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.