Firebase Rules Checker
Are my Firebase security rules open?
A Firebase web config is meant to be public, so your database is protected by security rules alone - and a rule left in test mode, or loosened to read: true to unblock development, hands your data to anyone who finds the project URL in your bundle. This checker extracts that config from your deployed JavaScript and tests what your Realtime Database returns to an unauthenticated read.
What this checker looks at
Firebase config in your bundle
Downloads your deployed JavaScript and extracts the Firebase project and database URLs it initialises with.
Realtime Database public read
Requests your database root with a shallow read and no credentials. If keys come back, your rules allow anonymous access to the data underneath them.
Firebase private keys in client code
Flags a service-account private key or raw private key block shipped to the browser - a credential that ignores security rules entirely.
Read more →Public cloud storage listing
Checks whether cloud storage buckets referenced by your app list their contents to an unauthenticated request.
Endpoints around the database
Probes function and API paths, debug routes, and admin-looking endpoints to see which answer without a session.
Read more →The rest of the public surface
The same run also checks security headers, TLS, CORS, cookies, .env files, and source maps - open rules are rarely the only thing exposed.
Read more →How the Firebase Rules Checker works
- Step 1
Paste your app URL
Your live URL is the only input. No Firebase console login, no service-account JSON, no repository access, and no Ubserve account.
- Step 2
We read your config and test the rules
We fetch the page, download the JavaScript bundles it links to, and extract the Firebase project and database URLs. We then send an unauthenticated shallow read to the Realtime Database root, and check cloud storage buckets and function endpoints for unauthenticated access. Reads only - nothing writes to your database.
- Step 3
You get the report, partially unlocked
You see the issue count, a letter grade, and up to two findings in full, free. The rest - including the highest-severity findings and the copy-paste fix prompts - unlocks with a one-time report unlock or a plan.
Frequently asked questions
How do I know if my Firebase database is public?
Find your database URL in the JavaScript your app serves, then request it directly with no credentials: https://YOUR-PROJECT.firebaseio.com/.json?shallow=true. If you get a list of your top-level keys back instead of a permission-denied error, your security rules allow anonymous reads and anyone with your project URL can walk the tree. The project URL is in every visitor's bundle by design, so it is not a secret - the rules are the only control.
What are Firebase security rules?
Firebase security rules are a small declarative language that decides, per path or per document, who may read and write. They are evaluated on Google's servers on every request, which makes them the entire access-control layer for a client-side Firebase app - there is no backend of yours in the way. The common failure is not malice but momentum: permissive rules get set to get past an error during development, the app works, and nobody tightens them before launch.
How does the checker work?
It runs the standard Ubserve public scan. We fetch your URL, download the JavaScript bundles the page links to, and extract the Firebase project and database URLs from the config they initialise with. We then send an unauthenticated shallow read to the Realtime Database root and record what comes back, check referenced cloud storage buckets for public listing, and probe function and API endpoints for unauthenticated access. Every probe is a read.
Is it free? Do I need to sign in?
The scan is free and you do not need an account to run it. You get the issue count, a letter grade, and up to two findings shown in full - location, evidence, and severity - at no cost. The rest of the report stays locked, including the highest-severity findings and the copy-paste fix prompts you can hand to your AI coding tool. Unlocking everything is a one-time payment for that report, or a plan if you want repeat scans and monitoring.
Does Ubserve see my Firebase console, service account, or source code?
No. This scan only reads what your app already serves to the public: the HTML at your URL, the JavaScript bundles that page links to, HTTP response headers, TLS certificate details, and public DNS records. We never ask for a repository, a database password, a service-role key, or an app login, and we cannot see private source code or authenticated pages. When we find a secret in your bundle, we found it because your browser downloads it too - anyone viewing your site can read the same bytes.
Does this check my Firestore and Storage rules too?
Not in this free public scan. What runs here is what can be tested from your bundle alone: the Realtime Database shallow read, public cloud storage listing, exposed private keys, and unauthenticated function and API endpoints. Enumerating Firestore collections and Storage objects properly needs your project details rather than guesswork, so that lives in the connected audit instead. This page tells you honestly what it tested and what it did not.
What founders say
5.0 out of 5 - Ubserve, from 3 reviews
“Helped me find a critical database issue that would've done real damage. I recommend it for every founder.”
“Caught a critical CSP issue on my frontend within minutes. Don't ship without a scan.”
“The free scan took under 60 seconds to find real issues in my project.”
Other free tools
See all tools →
DatabaseSupabase RLS Checker
Probes your Supabase tables with the anon key from your own bundle to see which ones answer without Row Level Security.
Open tool →Exposed API Key Scanner
Downloads your deployed JavaScript and matches it against key patterns for 30+ providers, from Stripe to OpenAI to AWS.
Open tool →Website Vulnerability Scanner
The full public scan: bundles, headers, TLS, CORS, endpoints, DNS, and database exposure in a single pass.
Open tool →Keep reading
- What is Row Level Security?Firebase rules' equivalent on the Postgres side.
- Broken access control in AI-built appsWhat open rules turn into in practice.
- How to remove exposed API keys from your frontendSeparating a public config from a real credential.
- Pre-deploy security checklist for vibe-coded appsThe last pass before you ship.
- Why vibe-coded apps keep getting hackedOpen database rules are the recurring headline.
Run the Firebase Rules Checker
Paste your URL and see what your app is handing to the public. Free, no account, no repo access.