firebase-security-rules-auditor

Audit Firestore rules by comparing create and update logic for bypass opportunities, verifying ownership checks on sensitive fields, and testing type and size validation. This Skill automates that red-team checklist and returns a scored JSON report with findings and fixes.

Common mistakes include trusting user-provided role fields, allowing updates that bypass create-time validation, missing string length limits enabling storage abuse, and using hasOnly() or diff() without ownership checks. Each maps to a specific severity level in the audit.

A single hardcoded admin email is acceptable if email_verified is also checked and no mechanism lets other users grant themselves admin. The audit does not penalize this pattern when those conditions hold, but flags escalation paths.

Rules can pass functional tests while allowing update bypasses, where a valid document is created then updated into a malicious state. Field-level restrictions without identity checks also let any authenticated user modify others' documents.

Run the audit whenever security rules are updated, before deploying to production, and after adding new collections or role logic. Catching rule flaws before deployment prevents unauthorized data access and privilege escalation.