SniffPupFree Firebase security rules checker (live site)
Paste your live URL to see whether a stranger can read your Firebase data. Your Firebase config ships in your frontend, and that's normal. Your security rules are what keep strangers out, and rules left open from test mode are easy to miss before launch.
This runs SniffPup's normal free scan, so you get the whole report, not just this one check. Firebase results are listed as “Anyone can read your Firebase Realtime Database”, “Anyone can read your Firestore collection …” or “Anyone can list the files in your Firebase Storage bucket”. The free report lists every issue it finds with its severity, plus the full fix free for every critical issue (with no critical, one other fix). Only scan sites you own or are authorized to test. What the scanner does and never does.
What this checks
- Realtime Database: one shallow, anonymous read of the database root. If it returns data, your rules allow public reads. Reported as critical. We keep nothing but whether the answer was empty.
- Firestore: an anonymous request for one document name (no fields) in each of four common collections:
users,profiles,ordersandmessages. A readable collection is reported as critical. - Storage: an anonymous request to list one file in your bucket. If listing works, strangers can find and download uploads. Reported as high.
- As part of the same free scan: secret keys in your HTML and JavaScript, public
.envand.gitfiles, source maps, security headers and HTTPS.
These checks only use the public config your site already ships, only send read requests, and only run when your site uses Firebase. Open data is shown in full on the free scan, because anyone could be reading it right now.
What it can't tell you
- It can't read your rules themselves. It only learns what an anonymous visitor gets back.
- It doesn't test writes, Firestore collections with other names, signed-in users reading each other's data, or Cloud Functions.
- It doesn't log in, and it scans live web URLs only, not native mobile apps.
- A 100 score means no issues were found in our checks. It is never proof of security.
Check it yourself
- In the Firebase console, open the Rules tab for Firestore, Realtime Database and Storage.
- Look for
if true,".read": trueor arequest.time <date rule. Each one means open to everyone (or until that date). - Limit access to signed-in owners, for example
allow read, write: if request.auth != null && request.auth.uid == userId;, and test it in the Rules Playground. - Sign out, confirm you can't read anyone's data, then scan again.
More: Is your Firebase database still in test mode? and the vibe-coded app security checklist.
Questions
How does SniffPup know my Firebase project?
From the public Firebase config your site already sends to every visitor: the project's firebaseapp.com domain, the Realtime Database URL and the Storage bucket name, found in your page HTML or same-origin JavaScript. That config is meant to be public. Your security rules are what protect the data.
Which requests does it make to Firebase?
Only reads, as an anonymous visitor: one shallow read of your Realtime Database root, a names-only read of one document in each of four common Firestore collections (users, profiles, orders and messages), and a one-file listing of your Storage bucket. It never writes, never signs up or signs in, and keeps nothing except whether each answer was empty.
My rules are open. What should I do?
Change the rules so only signed-in users can read and write their own data, test them in the Firebase console's Rules Playground, then sign out and confirm you can't read anyone's data. Scan again to check the outside view.
Does a clean result mean my Firebase rules are safe?
No. A clean result means none of these anonymous reads returned data. It doesn't check writes, collections with other names, signed-in users reading each other's data or Cloud Functions. Review your rules in the Firebase console too.
Does it work for native mobile apps?
No. SniffPup scans live web URLs only, not native iOS or Android apps.