Claude Code + Firebase Security
Claude Code writes Firebase integration code accurately — but Security Rules live outside the files Claude edits by default. Without prompting, your Firestore remains on test mode rules.
Why Claude Code + Firebase?
Developers using Claude Code often ask it to scaffold Firebase auth, Firestore CRUD, and real-time listeners. Claude can write clean client SDK code — but firestore.rules requires an explicit request and careful review of the output.
Common Vulnerabilities
These are the security issues we find most often in Claude Code apps using Firebase.
Security Rules Not Created Unless Requested
Claude Code modifies source files you ask it to work on. Unless you explicitly ask for Security Rules, your Firestore will run with the default test mode rules.
Admin SDK Suggested for Server Actions
When asked to implement server-side Firebase operations, Claude may suggest firebase-admin correctly for Cloud Functions but incorrectly for client components.
Overly Broad Rule Patterns
Claude-generated rules may use wildcards like {document=**} that grant access to entire subcollection trees beyond the intended scope.
Context Window Contains Sensitive Config
If you paste service account JSON into the Claude Code context for troubleshooting, it may be echoed back into generated code.
What We Check for Claude Code + Firebase
Security Rules Coverage
Verify a firestore.rules file exists with production-grade rules, not test mode defaults.
Admin SDK Placement
Confirm firebase-admin is only used in server-side files, not in component files.
Wildcard Rule Scope
Review rules for overly broad wildcards that unintentionally expose subcollections.
Credential Handling
Check that no service account credentials appear in client-side bundles.
Quick Security Wins
Apply these fixes right now to improve your security.
Ask Claude Code explicitly: 'Create a firestore.rules file with rules that require auth.uid == userId for all user document operations'Review every file Claude edits for 'firebase-admin' imports and verify it is server-side onlyTest generated rules in Firebase Emulator before deployingNever paste service account JSON into the Claude Code session — use environment variables insteadAsk Claude to scope rules per-collection rather than using catch-all wildcardsThe Bottom Line
Claude Code + Firebase is a capable combination when you direct Claude to create Security Rules alongside feature code. Make Security Rules a required deliverable in every Firebase prompt.
Secure Your Claude Code + Firebase App
Find Security Rules misconfigurations, exposed credentials, and other vulnerabilities before attackers do.
Start Security ScanFrequently Asked Questions
Does Claude Code automatically write Firebase Security Rules when it builds features?
No, not unless you ask. Claude Code edits the files you direct it to. If you ask it to add a Firestore query, it updates the component file. The firestore.rules file remains unchanged unless you explicitly request it.
How do I get Claude Code to write good Firestore Security Rules?
Provide your data model and describe who should access what. A good prompt: 'Write production Firestore Security Rules for a users collection where users can only read and write their own document.' Then test the output in the Firebase Emulator.
Can I safely give Claude Code access to my Firebase service account?
Never paste service account JSON into the Claude Code session or any file in your project. Reference it by environment variable name only. Claude can write code that reads from process.env.FIREBASE_SERVICE_ACCOUNT without seeing the actual credentials.
What is the difference between Firebase client SDK and Admin SDK?
The client SDK runs in the browser and respects Security Rules — it is safe for frontend code. The Admin SDK runs server-side, bypasses all Security Rules, and requires a service account. Always verify firebase-admin imports appear only in server-side files.