How to do a security audit of a Firebase app?

Why a Firebase-specific audit (not a generic web audit)

A generic OWASP audit will tell you your Firebase app "needs CSP headers." A Firebase-aware audit tells you that your specific Firebase app has an RPC function callable without auth or a service key in a client bundle — the issues that actually appear when Firebase apps get compromised. The difference in output value is why the audit should be scoped to Firebase's real failure modes.

Step 1 — Fingerprint the deployment

Confirm the Firebase stack components: database (firebase), hosting, auth provider, third-party integrations. For Firebase apps this is often visible in the Firebase endpoint URL in network requests. Document every component — each is an independent audit target.

Step 2 — Automated scan with Firebase-aware rules

Run VAS against the deployed URL. The scan probes the specific issue classes found in Firebase apps: security rules, credential exposure, auth configuration, security headers. This is the 80/20 — most critical and high findings surface here. Fix anything critical before continuing to manual steps.

Step 3 — Manual Firestore Security Rules review

Open the Firebase Console → Firestore → Rules. Every match path needs explicit `allow read/write: if request.auth.uid == resource.data.userId` (or similar ownership check). Storage rules require the same. Use the Firebase Emulator to test: a `firebase emulators:exec` with a write attempt as an anonymous user must fail.

Step 4 — Authentication & authorization probing

Test every endpoint with no session (expect 401), with a valid session for a different user (expect 403 on user-owned resources), and with session tokens that have been tampered with (expect 401 if signatures are enforced). For Firebase specifically, watch for auth without authorization — rules check if user is logged in but not if they own the data.

Step 5 — Re-scan to verify

Fix findings in severity order (critical → high → medium → low), re-scan after each batch of fixes. "I applied the fix" is not evidence — the fix might not have been deployed, might have been partial, or might have been reverted. Only the scan output proves the gap is closed. Log each finding + fix + verification scan for compliance records.

Firebase-specific checks often missed

• Test Mode Rules in Production (fix: Replace test rules immediately)
• Auth Without Authorization (fix: Add request)
• Admin SDK Credential Exposure (fix: Admin SDK is server-only)
• Storage Rules Misconfiguration (fix: Write storage)