Question 1

Are Firebase Security Rules secure by default?

Accepted Answer

Firebase Security Rules are not secure by default in most configurations. When creating a new Firestore or Realtime Database, Firebase offers test mode which allows unrestricted read and write access for 30 days. Many developers forget to update these rules before going to production, leaving their database fully exposed. Production mode starts locked down but requires developers to write proper rules for their data model. UNPWNED checks your Firebase project for overly permissive security rules and flags databases that allow unauthenticated access.

Question 2

Is the Firebase API key a secret?

Accepted Answer

The Firebase API key is not a secret and is designed to be included in client-side code. It serves as a project identifier rather than an authentication credential, similar to a public project ID. The API key alone cannot read or write data since that access is controlled by Firebase Security Rules and Firebase Authentication. However, if security rules are misconfigured, anyone with the API key can access your data because it is publicly visible in your JavaScript bundle. UNPWNED verifies that your Firebase project has proper security rules in place so that the public API key cannot be exploited for unauthorized data access.

Question 3

How do I secure Firestore properly?

Accepted Answer

Firestore security requires writing granular Security Rules that validate authentication, authorization, and data structure for every collection and document. Rules should check request.auth to verify the user is authenticated and validate that they only access their own data using resource.data fields. You should also validate data types and required fields in write rules using request.resource.data. Avoid using wildcards like match /{document=**} with broad allow rules, as this exposes your entire database. UNPWNED scans your Firestore configuration and identifies rules that are overly permissive or missing authentication checks.

Question 4

How do Firebase Storage Security Rules work?

Accepted Answer

Firebase Storage Security Rules control who can upload, download, and delete files in Cloud Storage buckets. Rules are written in a similar syntax to Firestore rules and can check authentication state, file metadata, file size, and content type. A common mistake is allowing any authenticated user to read all files or upload files without size and type restrictions, which can lead to data leaks or abuse. Storage rules should scope access to user-specific paths and validate file properties on upload. UNPWNED tests your Firebase Storage rules for misconfigurations that could allow unauthorized file access or unrestricted uploads.

Question 5

Can Firebase apps be hacked?

Accepted Answer

Firebase apps can be compromised if security rules are misconfigured, which is a widespread issue. Since Firebase configuration including the API key and project ID is embedded in client-side code, attackers can discover your project details and interact with your database directly using the Firebase SDK or REST API. Without proper security rules, an attacker can read all user data, modify records, or delete entire collections. Insecure Cloud Functions can also be exploited if they lack proper input validation or authentication. UNPWNED identifies these vulnerabilities by testing your Firebase endpoints for unauthorized access patterns.

Question 6

How secure is Firebase Authentication?

Accepted Answer

Firebase Authentication provides secure identity management with support for email/password, OAuth providers, phone auth, and anonymous auth. The service handles token generation, session management, and password hashing automatically. However, authentication alone does not protect your data since security rules must verify the auth token on every database and storage operation. Common issues include not enabling email verification, allowing anonymous auth without restricting what anonymous users can do, and not implementing proper account deletion flows. UNPWNED checks your authentication configuration alongside your security rules to ensure they work together to protect user data.

Question 7

How can I test Firebase Security Rules?

Accepted Answer

Firebase provides the Rules Playground in the Firebase Console where you can simulate read and write operations against your security rules with different authentication states. The Firebase Emulator Suite lets you test rules locally with unit tests using the @firebase/rules-unit-testing library. You should test that unauthenticated requests are denied, that users cannot access other users data, and that write validation rules reject malformed data. The Firebase CLI also supports deploying rules independently for testing before production rollout. UNPWNED performs automated external testing of your Firebase security rules to catch misconfigurations that local testing might miss.

Question 8

What are the most common Firebase security mistakes?

Accepted Answer

The most common mistake is leaving test mode security rules in production, which grants full read and write access to everyone. Other frequent issues include using allow read, write: if true in rules, not validating data structure in write rules, and exposing Cloud Function endpoints without authentication. Developers also commonly store sensitive data in the Realtime Database without encryption and fail to implement proper user data isolation in multi-tenant applications. UNPWNED detects these common misconfigurations by testing your Firebase project externally and reporting each vulnerability with remediation steps.

Question 9

How does Firebase security compare to Supabase security?

Accepted Answer

Firebase uses a custom rules language to define access control, while Supabase uses PostgreSQL Row Level Security policies written in SQL. Firebase rules are evaluated in a sandboxed environment and cannot perform joins or complex queries, while Supabase RLS policies have full access to SQL including subqueries and functions. Both platforms require explicit security configuration and are not secure by default. Firebase offers a Rules Playground for testing, while Supabase provides an RLS debugger in the dashboard. UNPWNED scans both Firebase and Supabase projects, detecting platform-specific misconfigurations for each.

Question 10

What are the security best practices for Firebase?

Accepted Answer

Always write specific security rules for every collection and never deploy test mode rules to production. Validate all data fields in write rules including type checking, required fields, and allowed values. Use Firebase App Check to prevent unauthorized clients from accessing your backend services. Implement proper user isolation by scoping all rules to request.auth.uid and restrict Cloud Functions to authenticated users where appropriate. Regularly audit your rules using the Firebase Emulator Suite and enable Google Cloud audit logging for your project. UNPWNED provides ongoing monitoring of your Firebase security configuration and alerts you to new vulnerabilities.

Firebase Security Questions