Use this checklist to ensure your Firebase application is secure before launch. 3 critical items require immediate attention.
Never deploy 'allow read, write: if true'
Verify request.auth != null
Check data types and fields
Verify rules before deployment
Firebase config in frontend is OK
Never expose admin SDK credentials
Configure API restrictions in Google Cloud
Require users to verify email
Only enable needed providers
Protect against abuse
Don't leave storage open
Restrict uploadable file types
Prevent abuse via large uploads
VAS automatically checks 3 of these 13 items. Get instant results with detailed remediation guidance.
Run Automated Security Scan