Check Firebase @CheckFirebase
Free Firebase security scanner. Enter your domain, we check your Realtime DB, Firestore, Storage and Auth rules in a minute. Read-only. Fixes included. checkfirebase.com *.firebaseio.com / *.web.app Joined September 2026-
Tweets36
-
Followers35
-
Following0
-
Likes4
Today's anonymized scan: a live app with a public Realtime Database. 250,000 user records readable with a single GET to the .json endpoint. Birth date, email and names.. The fix is one line in the rules.
You shipped it with Lovable/Cursor in a weekend. The security rules are still `allow read, write: if true`. Check your domain for free before someone dumps your users table.
Before production, worth checking what your Firestore and Storage rules actually expose. Default rules often leave allow read, write: if true, or lock reads behind request.auth != null while self-signup is open. A read-only scan at checkfirebase.com shows this in about a minute.
@volumemaker_ :)) guess how many we found since we launched?
@SANDEEPKOMMINE1 Guess how many we found since we launched?
What the free scan does: fetches your site, pulls the Firebase config your app already exposes, then runs read-only probes against Realtime Database, Firestore, Storage, and Auth. Nothing gets written. Write tests only run after you prove you own the domain.
@SidraCodeAudit @SwapPay Better not use Firebase
@AIQuickFindings Firebase Storage rules can check request.auth.uid against object metadata, but the default template just checks request.auth != null. That is where the row-level logic gets lost: any signed-in account passes, not just the owner. Most buckets we see never move past that default.
Their database rules were locked down. Their file storage was not. One rule, `allow read: if request.auth != null`, plus open signup, let any account download 1,000+ license PDFs from a live app. DB tight? Check the bucket too. Free, read-only, one minute.
@momelavelle Agreed. The default allow read, write: if true on Firestore or Storage is the most common exposure we see, not a deliberate choice. Free read-only scan at checkfirebase.com shows exactly what's open before it becomes a launch blocker.
@coldboothq @PrajwalTomar_ That debug-to-prod slip is the most common finding: allow read, write: if true left after shipping. A read-only scan at checkfirebase.com flags it, plus Storage rules often left open.
@IgTxtrs Use our service, checkfirebase.com
The finding that should worry you most is not a readable database. It's Firestore allowing unauthenticated writes, where anyone can add, edit, or delete documents in production.
@joshforweb :)) don't leave any holes unfilled
@LobsterClawSoft That limit is real: rules cap the number of expressions evaluated per check, and past it the write is denied without a clear error. Fix: denormalize ownership checks into flat fields so the rule reads one value instead of walking the tree.
@ShinigamiSukuna @anmol_biz Public listing on a Storage bucket usually means database rules got locked down but the default storage.rules were left untouched. Fix: scope list and get to owner's path, not bucket root. Free scan at checkfirebase.com shows every reachable path.
Built something with Lovable or Cursor last weekend? The Firestore rules it generated probably let anyone on the internet read your users collection. Paste your domain here and see: checkfirebase.com
@Uday_krn Worth adding: SHA fingerprints and App Check confirm the request came from your real app, but they don't scope what that app can read or write. A trusted client still hits whatever your Firestore or Realtime Database rules allow. Two separate layers.
Aayush Ajay Wanve @aayucooldev
44 Followers 838 Following Curating the best in tech, modern AI productivity tools, and clean web aesthetics. 🚀 Helping you optimize your digital workflow and build faster.
Dewey @Deweythe2
1K Followers 6K Following SaaS Growth | Helping B2B SaaS companies scale | Growth systems & acquisition
Ayush 🪄🕯️ @portraitcoder
164 Followers 251 Following Aspiring Software Engineering | Mern stack | Dsa with Java | Photography
Vineet Mangal @namevinu
41 Followers 1K Following
Logosvoyage @Logosvoyage998
17 Followers 376 Following
India - Unseen by Ind... @indiarealized
31 Followers 297 Following Motivational handle to make Indians realise their swadharma, and own up to take responsibility in leading the Indian civilization. Opinions only based on facts
manish · building Ag... @manish_iitg
362 Followers 282 Following Manish builds AgentWorks — open-source AI agents that run business workflows, measure outcomes, and improve every run. Follow the build in public.
Heet Chaudhari @theheetchaudhri
8 Followers 94 Following
Lil Bindle @YungBindlestiff
110 Followers 6K Following
Victoria Ustimenko-La... @BusinessViki
763 Followers 5K Following #Founder&#CEO at @pretobusiness, advisory board at @LifeboatHQ
امیر گوناگو... @amirgoonagoon
8 Followers 392 Following
rahul handsomner @rahulhandsomner
152 Followers 1K Following
Raman Vijay @RamanVijay5
37 Followers 602 Following
Bhuyan Pravin @BhuyanPrav6173
63 Followers 3K Following
KumarVel @AIKumarvels
39 Followers 2K Following AI -Technology and Business Leader with expertise in enterprise solutions, cybersecurity, and product management across BFSI and healthcare sectors.
MKB @heysevenempest
109 Followers 2K Following
Anusha K @aiwithanu
386 Followers 4K Following Machine Learning Engineering Graduate|| Open for remote(worldwide) and Bangalore roles. - Fresher. @atoms_dev ambassador, recipient @aigrantsindia
Boyplunger @boyplunger53
68 Followers 1K Following
mark carballo @markcarballo5
9 Followers 22 Following
Glücksritter @MindsOoo
2K Followers 4K Following
Jesse @Jesse_Sng
134 Followers 4K Following
You might like
