Checker
Firebase rules checker
Paste the deployed URL. LeakWatch looks for a Firebase project in the page, then makes one shallow read of the Realtime Database root and one Firestore list. Open rules are reported. The documents are not stored.
The free report names every finding, with its severity and category. The most serious one is shown in full. The others keep the location, evidence, and fix prompt for the $19 Proof Report. One free scan per network every 30 days.
What this page is for
Open rules
A database that answers an unauthenticated read is the finding. The web API key next to the client config is public configuration and is ranked info.
What is not checked
This does not download your rules file from the Firebase console, and it does not sign in as a user. A database that refuses the request is a pass for that check.
A service account in the bundle
A Firebase Admin service account in client code is a leak. It is reported separately and is not used to query the project.
Questions
- Will you write to my database?
- No. The check is a read. It does not create documents or change rules.
- Does a public web API key mean the rules are open?
- No. That key is meant to be in the browser. The rules check is the read that follows it.
A Proof Report is $19 once. Monitoring is $9/month. Pro is $29/month. No subscription is required for the report. See pricing.