Find Firebase security misconfigurations before attackers do

FireScan is a free, open-source command-line tool that audits the security of a Firebase project. Point it at your project ID and API key, and it checks what an outsider, or any signed-in user, can actually read, list and reach across Realtime Database, Firestore, Cloud Storage, Cloud Functions, Authentication and Hosting.

go install github.com/JacobDavidAlcock/firescan/cmd/firescan@latest

firescan
firescan > set projectID my-app
firescan > set apiKey AIza...
firescan > auth --create-account
firescan > scan --all

Install FireScan · Run your first scan · View on GitHub

Why Firebase apps leak data

Every Firebase web and mobile app ships its project ID and API key to the client. That's by design: the key identifies your project, and it isn't a secret. What protects your data is your Security Rules, and they're easy to get wrong:

• Test-mode rules left in place after launch
• allow read, write: if request.auth != null, which lets anyone who signs up read everything
• Storage buckets that allow public listing
• Cloud Functions that never check who is calling them
• Config files like .env or .git/ accidentally deployed to Hosting

Firebase's emulator and Rules Playground test the rules you think you deployed. FireScan tests the project that's actually live, from the outside, the way an attacker would.

What FireScan checks

Service	What it tests
Realtime Database	Root exposure, node enumeration with built-in wordlists, read access
Firestore	Collection discovery, document enumeration, read and list permissions
Cloud Storage	Bucket listing, file enumeration, public object access
Cloud Functions	Function discovery across 7 regions, whether functions require authentication
Authentication	Enabled sign-in providers, whether anyone can create an account
Hosting	Sensitive files such as .env, .git/HEAD and firebase.json
Unauthenticated access	What's reachable with no login at all: scan --unauth needs only a project ID

It can also test write access and security rules, Remote Config exposure, App Check enforcement and Cloud Messaging configuration. See scan types for the full list.

Safe to run against production

FireScan has three safety modes:

• Probe (default): read-only. Never creates, changes or deletes data.
• Test: writes clearly marked test data to isolated firescan-test- paths and tracks it for cleanup. Asks for confirmation first.
• Audit: deeper testing for staging environments or engagements that explicitly allow it. Also asks for confirmation.

Concurrency (-c) and rate limiting (--rate-limit) let you keep scans gentle on live projects.

Who it's for

• Developers checking their own app before launch, or after changing rules
• Teams shipping fast, including apps built with AI coding tools, who want a quick check that nothing is wide open. See securing an AI-built Firebase app
• Security testers and bug bounty hunters working on Firebase-backed targets that are in scope
• CI/CD pipelines: JSON output makes it easy to fail a build on new findings

Firebase security guides

• How to test Firebase security rules
• Is a Firebase API key a secret?
• Firebase Storage security rules explained
• Common Firebase security vulnerabilities and how to fix them
• Firebase Realtime Database security checklist
• All guides

Documentation

• Introduction: what FireScan does and how it works
• Installation: Go install, prebuilt binaries for Linux, macOS and Windows, or build from source
• Quick start: run your first scan in a few minutes
• Command reference: scan, auth, extract, set and wordlist
• Examples and FAQ

Need a hand? I also offer Firebase security reviews.

Authorization required

Only use FireScan on projects you own or have explicit, written permission to test. Testing systems without permission is illegal in most countries. FireScan is MIT-licensed and provided for authorized security testing only.