firebase-security-rules-auditor

Provide your Firestore rules to the auditor, which evaluates them against a red-team checklist covering update bypasses, authority sources, and ownership checks. It returns a JSON report with a 1-5 score, severity-rated findings, and specific fix recommendations.

An update bypass occurs when create rules validate data strictly but update rules are weaker, letting users create a valid document then update it into a malicious state. The audit compares create and update rules to detect this inconsistency.

Not necessarily. A single hardcoded admin email is acceptable if email_verified is also checked and the implementation prevents additional admins from self-assigning privileges. The audit only flags it when escalation risks remain open.

hasOnly() and diff() restrict which fields can change but not who can change them. Without an ownership check like resource.data.uid == request.auth.uid, any authenticated user can modify another user's document, creating a data integrity vulnerability.

A score of 5 indicates comprehensive validation, strict ownership, and secure role-based access. Scores of 1-2 indicate critical or major issues like data leaks or privilege escalation that must be fixed before deployment.