How checkfirebase works
We check the parts of Firebase that get left open most often, using only your app's own public configuration.
Recon
Every Firebase web app ships a config object to the browser with your project ID, database URL, and storage bucket. We read that same config — nothing private.
Read-only probes
We ask your Realtime Database, Firestore, Storage, and Auth whether they answer unauthenticated requests. A response that should have been denied is a finding.
Verified write-tests
Once you confirm you own the domain, we can safely test writes by creating and instantly deleting a single marker in a dedicated test path.
Report
Our analyzer turns the probe results into a ranked report with corrected security rules you can paste straight into Firebase.
Safe by design
Surface scans are read-only. Write-tests are non-destructive and gated behind your ownership confirmation. We store the findings, not your data.