How checkfirebase works
We check the parts of Firebase that get left open most often, using only your app's own public configuration.
Recon
Every Firebase web app ships a config object to the browser with your project ID, database URL, and storage bucket. We read that same config — nothing private.
Read-only probes
We ask your Realtime Database, Firestore, Storage, and Auth whether they answer unauthenticated requests. A response that should have been denied is a finding.
Verified write-tests
Once you confirm you own the domain, we can safely test writes by creating and instantly deleting a single marker in a dedicated test path.
Report
Our analyzer turns the probe results into a ranked report with corrected security rules you can paste straight into Firebase.
Domain checks
Whether or not you use Firebase, every scan also checks your email posture (MX, SPF, DMARC), flags email records that changed since your last scan, and asks VirusTotal whether any antivirus or URL-reputation engine has flagged the domain.
Safe by design
Surface scans are read-only. Write-tests are non-destructive and gated behind your ownership confirmation. We store the findings, not your data.