Insights · 6 min read
Firebase security rules: the mistakes we keep finding in live apps
By Austin Hunter ·
Firebase is a great way to ship fast. We run several of our own apps on it, and we've taken over client apps built on it. But with Firebase, the app talks to the database directly, so the security rules are the only lock on the door. The config values in your app aren't secret. Anyone can read them and call your database. Here's what we check first.
1. Rules left in test mode
Projects often start with rules that allow all reads and writes, sometimes with an expiry date someone extends rather than fixes. If your rules contain something like allow read, write: if true; (or a date check that keeps getting pushed back), every record is public.
2. "Signed in" treated as "allowed"
A rule that only checks request.auth != null lets any signed-up user read every other user's data. Most apps need the rule to compare the signed-in user's ID with the owner of the document (or their team or organization), not just check that someone is signed in.
3. Users can edit fields they shouldn't
If a user can update their own profile document, can they also change their role, plan, credits or isAdmin flag? Rules should limit which fields a user may change, and anything tied to payments or permissions should only be written by your server.
4. Storage rules forgotten
Firestore gets attention and Cloud Storage doesn't. Uploaded files (documents, photos, exports) often sit under rules that let any signed-in user read any path. Mirror your Firestore ownership checks in Storage.
5. Server-only collections readable by the app
Payment records, admin notes, internal logs and API keys stored in Firestore for a server function should be closed to the app entirely. Only the Admin SDK on your server should touch them.
How to check your app
- Read the rules file line by line, together with a list of every collection and storage path the app uses.
- Test from a second account: try to read and write another user's documents and files.
- Use the Firebase emulator and rules unit tests so a later change can't quietly reopen a hole.
- Turn on budget alerts and App Check, which makes abuse with your config harder and noisier.
Want a second pair of eyes?
Our Production health check is a one-week, read-only review for a fixed $990. Data access rules are the first thing on the list, followed by exposed keys, payments, backups and monitoring. You get a ranked fix list with a fixed price for each fix.