Last updated: January 12, 2026
Firebase is powerful but requires explicit security configuration. This guide covers the essential Security Rules and auth settings for production Firebase apps.
Never deploy with test mode rules. They allow anyone to read/write your entire database.
// BAD - Test mode
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if true;
}
}
}Rules should check authentication and validate data structure.
// GOOD - Production rules
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /users/{userId} {
allow read, write: if request.auth != null
&& request.auth.uid == userId;
}
}
}Service account keys should never be in client code. Use them only in Cloud Functions or server environments.
Use Firebase Emulator to test your Security Rules before deploying.
Enable email verification, configure OAuth providers securely, and set up proper password policies.
Scan your deployed app to verify rules are working as expected.
Avoid these common Firebase security pitfalls:
Use these tools to maintain security throughout development:
Security is an ongoing process, not a one-time checklist. After implementing these steps, use VAS to verify your Firebase app is secure before launch, and consider regular scans as you add new features.
Check Firebase Console > Firestore > Rules. Test mode rules contain 'allow read, write: if true' or check if date is before a timestamp. Firebase also shows a warning banner when test mode is active. VAS can detect test mode rules in deployed apps.
Authentication: 'request.auth != null' (user is logged in). Authorization: 'request.auth.uid == userId' (user can only access their own data). Always check BOTH - authentication alone means any logged-in user can access any data.
Yes! Use Firebase Emulator Suite: 'firebase emulators:start'. Write unit tests with @firebase/rules-unit-testing. Test positive cases (user can access own data) AND negative cases (user cannot access others' data, anon users blocked).
Common cause: you're using test mode rules locally but deployed stricter rules. Or you're signed in locally but not handling the auth state properly in production. Check browser console for Firebase permission errors and compare your rules.