Firebase apps
Firebase security rules audit: Firestore, Storage and keys checked.
A Firebase security rules audit checks that no one can read or change data they shouldn't. PixelRidge Web reviews the security rules for Cloud Firestore, Realtime Database and Cloud Storage, tests them as a signed-out visitor and as a second user, checks where admin credentials live, then fixes what's wrong and shows you how to test it yourself.
What we fix
Where Firebase apps usually need help.
Rules left in test mode
Test mode lets anyone read and write your database until a date in the rules. Apps often launch before anyone replaces them, or the date gets pushed forward.
Rules that only check sign-in
A rule that allows any signed-in user lets every user read every other user's documents, not just their own.
Storage open to everyone
Uploaded files such as IDs, photos and invoices are readable by anyone who has or guesses the path.
Admin credentials in the app
The Firebase web config is meant to be public, but a service account key or Admin SDK credentials must never ship to the browser or a mobile app.
Logic only in the front end
Prices, roles and limits checked only in the app's code can be bypassed. They belong in security rules or Cloud Functions.
How it works
Three fixed prices.
Check
US$29
3 days
We read your whole code and database and tell you what is wrong.
Fix and secure
US$79
7 days
Everything in Check, then we fix it.
Fix, secure and launch
US$129
14 days
Everything above, plus a working launch.
Prices in US dollars. You pay half to start and the rest only after you have tested the work. Bigger jobs are quoted in writing after the Check. See what each price includes.
Terms and conditions apply. Read the terms.
You own everything
The Firebase project should sit in a Google account your business owns, with at least two owners, billing alerts set, and any leaked service account keys deleted and replaced.
No findings, no fee
If our audit of your app or site finds nothing worth fixing, you don't pay for the audit.
Smaller one-off fixes start at $20 each in our price calculator. Moving off a builder's hosting is covered by Rescue & Migration, and keeping the app healthy afterwards by Launch Care.
Questions
Common questions about Firebase
Is my Firebase API key a secret?
No. Firebase's own documentation says the API key in your web config only identifies your project. What protects your data is your security rules, which is why the audit focuses on them.
How do I know if my Firestore database is open?
Look at your rules in the Firebase console. If you see allow read, write: if true, or a test-mode rule with a date, your data is open. The Rules Playground lets you test a request as a signed-out user.
What does the audit include?
Firestore, Realtime Database and Storage rules, tested as different users, plus where credentials are used in your code and Cloud Functions. You get a written report and a fixed price to fix what we find.
What if the audit finds nothing?
No findings, no fee. If our audit of your app or site finds nothing worth fixing, you don't pay for the audit. The first Launch Check is always free.
Is there a free way to check my app first?
Yes. The free PixelRidge security scan checks a live app you own for exposed keys, database tables readable without logging in, missing security headers and privacy basics. It is passive and read-only. For a human review, send your link for a free Launch Check and we record a short video of the top risks we see. Before launch, the free Launch Readiness Checklist scores your app on domain, security, data, legal and payments.
Want a quick first check? Score your app with the free launch checklist or see all free tools.
Send us your Firebase app's link.
We record a short video showing the top risks we see, free and with no obligation, then quote a fixed price.
Terms and conditions apply. Read the terms.