Thousands of Firebase apps leak data right now

Your Firebase database might be wide open right now.

One misconfigured rule and anyone on the internet can read your users, dump your data, or wipe it entirely. Enter your domain and find out in under a minute.

https://

I own this domain or am authorized to test it. Run the deeper active checks too. We sign up and immediately delete a temporary test account, and write then immediately delete a marker in a test path, to check for logged-in and write access issues. Non-destructive.

Advanced: deep-test an app behind Firebase App Check

If your app enforces App Check, an anonymous scan is blocked and can't see your rules. Paste tokens from a logged-in session so we can test what a real client and a signed-in user can actually reach. In DevTools → Network, open a request to firestore, firebasedatabase or firebasestorage and copy these request headers. Used once for this scan, never stored.

App Check token (header X-Firebase-AppCheck) Firebase ID token (optional; header Authorization: Bearer)

Requires the ownership box above. Tokens are short-lived, so scan right after copying them.

Enter the domain your app runs on, like app.example.com. Free surface scan, no signup. Read-only and non-destructive.

What an open rule actually costs you

Firebase makes shipping fast. The default that trips teams up is a security rule left as allow read, write: if true.

Your users, exposed

Email addresses, phone numbers, and sometimes plaintext passwords become readable by anyone who finds your database URL.

Your data, editable

An open write rule lets a stranger alter orders, inflate balances, inject spam, or delete every record you have.

Your files, downloadable

A public storage bucket exposes uploaded IDs, invoices, and private documents to bulk download.

How the scan works

Enter your domain

We fetch your site and find the Firebase config your app already ships to every visitor's browser.

We probe, safely

Read-only checks against your Realtime Database, Firestore, Storage, and Auth. Nothing is written or changed.

You get the fixes

A ranked report of every exposure with corrected security rules you can paste straight into Firebase.

What your report looks like

example.com 2 critical

CRITICAL Realtime Database is publicly readable

Anyone can read your entire database without logging in.

{ "rules": { ".read": "auth != null", ".write": "auth != null" } }

CRITICAL Firestore allows unauthenticated writes

Anyone can write documents to your database, enabling tampering.

Simple pricing

Firebase Security Report

$49.00

per full report

✓Every exposure ranked by severity
✓Copy-paste corrected security rules
✓Optional verified deep write-test
✓Free re-scan to confirm the fix

Scan your site first

See what's exposed before you pay a cent.

Read-only by default

Surface scans only read the config your app already exposes publicly.

Non-destructive

Write-tests create then instantly delete a single marker in a test path.

Ownership-gated

Deep write-tests run only after you confirm you own the domain.

We don't keep your data

We store the findings, not your database contents.