Your Firebase backend.
Not just an if request.auth check.
The false sense of Firebase security usually comes from a rule that looks fine on paper but still lets any signed-in user read or modify another user's data. This audit checks Firestore rules, Storage, Functions, and Auth flows in the context they actually run in.
What we verify
Firestore Security Rules
Read and write rules, user or organization separation, sensitive collections, and actual ownership logic.
Firebase Storage
Documents, images, exports, and attachments reachable without the right level of authentication — or through URLs that are too permissive.
Auth and application roles
Too much trust in the frontend, custom claims, admin logic, session verification, and what the client is actually allowed to decide.
Cloud Functions and webhooks
HTTP or callable functions that trust input too much, skip real validation, or can be triggered from outside more easily than the team expects.
What we often find
allow read, write: if request.auth != null
The most common rule — and one of the most dangerous. Any signed-in user can reach any other user's data.
Storage weaker than Firestore
Firestore rules get attention; file buckets stay open or end up far broader than intended.
Functions that trust the client
A Cloud Function takes a userId, role, or amount straight from the frontend — with no serious server-side check behind it.
Identity disconnected from data protection
Login works fine, but isolation between users, teams, or customers isn't actually enforced.
Ideal for
- Mobile or web apps built on Firestore and Firebase Storage
- Products shipped fast with decent Auth but rules that were never seriously reviewed
- Client portals, member areas, HR tools, e-learning apps, or marketplaces
- Teams that want to verify cross-user isolation before a client finds the gap for them
Related reads and pages
Why request.auth != null is not enough
The most common Firestore rule mistake, walked through with concrete examples.
Supabase vs Firebase
A side-by-side look at the security models of the two most common backend platforms.
API & webhook audit
Worth pairing when Firebase Functions also expose HTTP endpoints or real-time callbacks.
Full Audit
When you want the whole application surface documented, not just the Firebase layer.