skills.rest
nikhilkakarla
nikhilkakarlaCOMMUNITY
Explore all skills by this author →
GitHub

firestore-security-rules-auditor

Audits Firestore security rules against a penetration-testing checklist and returns a scored JSON report.

Updated Aug 5, 2024
Search Tags:#vulnerability#access control#audit#penetration testing#firebase#security rules#firestore
One-click install
npx skills add https://github.com/nikhilkakarla/nikhilkakarla.github.io --skill firestore-security-rules-auditor-nikhilkakarla
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: firestore-security-rules-auditor
Source: https://github.com/nikhilkakarla/nikhilkakarla.github.io/tree/main/.agents/skills/firestore-security-rules-auditor
Command: npx skills add https://github.com/nikhilkakarla/nikhilkakarla.github.io --skill firestore-security-rules-auditor-nikhilkakarla

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Firestore security rules often contain subtle vulnerabilities like update bypasses, privilege escalation paths, and missing validation that developers overlook. This Skill systematically audits your rules from an attacker's perspective to find exploitable holes before they reach production. ## Core Features & Use Cases - Red Team Audit Checklist: Evaluates rules against six mandatory checks including update bypasses, authority source validation, business logic alignment, storage abuse limits, type safety, and field-level versus identity-level security. - Scored Findings Report: Returns a structured JSON assessment with a 1-5 security score, severity-rated findings, and concrete remediation recommendations. - Admin Bootstrapping Awareness: Correctly handles single hardcoded admin email patterns without penalizing them when email verification is enforced. - Use Case: After generating or updating Firestore security rules for a collaboration app, run this audit to confirm collaborators can read shared data while preventing users from escalating their own roles. ## Quick Start Audit my Firestore security rules in firestore.rules and report any vulnerabilities with a security score.

Frequently Asked Questions about firestore-security-rules-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Firestore security rules for vulnerabilities?▼

Provide your Firestore security rules to the auditor, which evaluates them against a six-point checklist covering update bypasses, authority sources, business logic, storage limits, type safety, and ownership checks. It returns a JSON report with a score and findings.

What is an update bypass in Firestore security rules?▼

An update bypass occurs when create rules validate data strictly but update rules are weaker, letting users create a valid document then update it into a malicious state. The audit compares create and update rules to detect this inconsistency.

Does a hardcoded admin email in Firestore rules count as a vulnerability?▼

No, a single hardcoded admin email is acceptable if email_verified is also checked and no escalation path lets other users add themselves as admins. The audit explicitly accounts for this bootstrapping pattern without lowering the score.

Why do Firestore rules using hasOnly or diff still have vulnerabilities?▼

hasOnly() and diff() restrict which fields can be updated but not who can update them. Without an ownership check like resource.data.uid == request.auth.uid, any authenticated user can modify another user's document fields.

What security score do Firestore rules need to be considered secure?▼

A score of 5 indicates comprehensive validation, strict ownership, and role-based access via secure ACLs. Scores of 1-2 indicate critical or major issues like data leaks or privilege escalation that require immediate fixes.

Related Skills

Explore More Software Engineering Skills→
xbg-solutionsxbg-solutions

firebase-firestore-standard

Provision Cloud Firestore Standard Edition and write security rules with the Firebase CLI.

Official
Intermediate
AbdelrhmanUZakiAbdelrhmanUZaki
2

firebase-auth-basics

Configure Firebase Authentication providers, client SDKs, and security rules for apps.

Community
Intermediate
iv-zhangiv-zhang
2

bmrc-testing

Runs and extends Firestore emulator test suites for the BMRC logistics application.

Community
Advanced
harshvardhan-singh-dhakadharshvardhan-singh-dhakad

firebase-hosting-basics

Deploy static web content to Firebase Hosting using the Firebase CLI.

Community
Intermediate