Home / Fix guides / Verify Firebase Security Rules

Firebase Security Rules check for AI-built apps

Needs verification

Unspill found Firebase configuration in your page. That's expected for Firebase web apps, but it means your Security Rules are what stands between strangers and your data. Unspill did not query your database.

Why it matters

Rules left in 'test mode' (allow read, write: if true, or time-limited test rules) let anyone read and write everything.

Quick fix

Firebase Console → Firestore → Rules: make sure there's no 'allow read, write: if true'.
Do the same for Realtime Database and Storage.
Scope access with request.auth.uid.
Use the Rules Playground to test as an unauthenticated user.

Step by step

Example rules

Users can only read and write their own document:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
  }
}

Prompt for your AI builder

Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.

Write Firebase Security Rules for Firestore, Realtime Database and Storage so that no collection is world-readable or writable, users can only access documents they own (request.auth.uid), and public data is read-only. Explain each rule.

FAQ

Is my Firebase apiKey a secret?

No. Firebase web API keys identify your project and are meant to be in client code. Security comes from Security Rules and, optionally, App Check.

References

Check your app

Run a free scan