Last updated: January 12, 2026
Use this checklist to ensure your Firebase application is secure before launch. 3 critical items require immediate attention.
Never deploy 'allow read, write: if true'
Verify request.auth != null
Check data types and fields
Verify rules before deployment
Firebase config in frontend is OK
Never expose admin SDK credentials
Configure API restrictions in Google Cloud
Require users to verify email
Only enable needed providers
Protect against abuse
Don't leave storage open
Restrict uploadable file types
Prevent abuse via large uploads
VAS automatically checks 3 of these 13 items. Get instant results with detailed remediation guidance.
Run Automated Security ScanCheck Firebase Console > Firestore > Rules. Test mode rules contain 'allow read, write: if true' or have a timestamp check that may have expired. Firebase shows a warning banner when test mode is active.
Yes, Firebase client configuration (apiKey, authDomain, projectId) is designed to be public. Security comes from Security Rules, not from hiding the config. The apiKey only identifies your project to Google services - it doesn't grant access.