Firebase security rules

Firebase security rules checker

Find out if your Firebase Realtime Database, Firestore or Storage can be read by anyone on the internet.

I own this website, or have explicit permission from its owner to run these security checks.

Only scan authorized sites. Read the testing rules. Reports are private to this browser; keep its cookies to retain access. Use is subject to our Terms of Service.

Enter a public web page, such as your-app.com. APIs and downloads cannot be scanned here.

✓ No signup✓ Read-only✓ Masked evidence

The test-mode trap

When you start a Firebase project in test mode, its rules allow anyone to read and write until a date set in the rule. If those rules never get replaced — or get replaced with allow read, write: if true; — your data is public.

What we check

These backend checks require website ownership verification and separate operator approval of the database or storage project. Public references in your JavaScript do not authorize us to test those services.

Realtime Database — whether the root can be read without logging in.
Firestore — whether common collections like users, orders and messages are readable.
Cloud Storage — whether files can be listed publicly.

What secure rules look like

A typical owner-only rule for Firestore:

match /users/{userId} { allow read, write: if request.auth != null && request.auth.uid == userId; }

Your report includes a fix prompt that asks your AI builder to rewrite your full rules file this way.

A little check before you serve.

Bite-sized security checks. Clear security reports, with practical fixes and AI prompts.

Check my stack