Frequently asked questions
Is this legal to run on my own site?
Yes. Surface scans only read the Firebase config your app already exposes to every visitor. Write-tests run only when you confirm you own the domain or are authorized to test it.
Will the scan change or delete my data?
No. Read-only probes never write. The optional write-test creates then immediately deletes a single marker in a dedicated test path.
Do you store my database contents?
No. We store the findings and evidence snippets needed for your report, not your data.
What does the paid report include?
Every exposure ranked by severity, the concrete business impact, and corrected security rules you can paste into Firebase. Re-scans to confirm your fix are free.
What if you don't find Firebase on my site?
You won't be charged for a surface scan. If Firebase loads dynamically or sits behind auth, contact us for a manual review.