Test the rules behind your interface.
Firebase client SDKs make direct data access productive, which also makes security rules part of your application’s primary authorization layer. We test those rules without relying on what the UI hides.
Who it is for
Built for products where trust matters.
- Firebase web apps going into production
- Apps using Firestore or Realtime Database
- Products with user roles or moderation
- Teams relying on generated security rules
What we review
A focused review of the complete risk surface.
Firebase security audits for Firestore, Realtime Database, Storage, authentication, roles and callable functions.
Authentication and custom claims
Document ownership and field validation
Cloud Storage access rules
Callable and HTTP function authorization
Admin, role and moderation workflows
Issues we investigate
Specific findings, not generic warnings.
You receive validated examples of unsafe reads or writes and clear guidance for strengthening rules, claims and server-side checks.
Open collection access
Authenticated or anonymous clients can enumerate documents outside their intended scope.
Unrestricted field updates
Users can modify roles, balances, status or ownership fields through direct writes.
Client-trusted identity
Local storage or editable client data is treated as proof of identity or privilege.
Function authorization gaps
A callable or HTTP function performs a sensitive action without rechecking the user and target resource.
The deliverable
Evidence your team can act on.
You receive validated examples of unsafe reads or writes and clear guidance for strengthening rules, claims and server-side checks.
Explore the sample report →Every finding includesSeverity and priorityEvidence and reproductionBusiness and user impactPractical remediation
Questions
Good to know.
Need help choosing a scope? Contact the audit team directly.
Is Firebase configuration safe in frontend code?+
The client configuration is generally public. Security depends on rules, authorization and protection of privileged server credentials.
Can you test without production data?+
Yes. A test project or carefully prepared test accounts are preferred wherever practical.
Do you review Cloud Functions?+
Functions connected to the audited journeys can be reviewed under the Comprehensive Audit.
Ready when you are
Find the issues before users do.
Choose the audit depth that fits your application and receive a clear, prioritized report.
View audit plans →