Check your Firebase security rules against 26 common mistakes
Paste your Firestore security rules, Firebase Storage rules or Realtime Database rules. The checker reads the text and shows which paths let anyone read or write.
Result
This is static analysis of pasted text. It cannot see custom claims, App Check, data shape or rules that were never deployed; the grade covers only what the 26 checks can read.
What this check cannot see
The checker reads only the pasted text. It cannot see custom claims, App Check, the shape of your data or rules that were never deployed, so a clean result does not mean the project is safe.
All 26 checks
| Check | Id | Service | Severity |
|---|---|---|---|
| Anyone can write to Firestore | fs-open-write | Firestore | Critical |
| Anyone can read from Firestore | fs-open-read | Firestore | Medium |
| A recursive wildcard match is open | fs-recursive-wildcard-open | Firestore | Critical |
| Test mode rules with an expiry date | fs-test-mode-expiry | Firestore | Critical |
| Any signed-in user can write | fs-auth-only-write | Firestore | High |
| Any signed-in user can read | fs-auth-only-read | Firestore | Medium |
| Email trusted without email_verified | fs-email-unverified | Firestore | Medium |
| Role read from the request data | fs-role-from-request | Firestore | High |
| A broad wildcard hides stricter rules | fs-wildcard-shadow | Firestore | High |
| Users can write their own role (heuristic) | fs-self-role-write | Firestore | High |
| Writes accept any fields (heuristic) | fs-write-no-field-guard | Firestore | Medium |
| read is not split into get and list | fs-read-not-split | Firestore | Info |
| No explicit default deny | fs-no-default-deny | Firestore | Info |
| Firestore rules did not parse | fs-parse-error | Firestore | Info |
| Anyone can read Storage files | st-open-read | Storage | Medium |
| Anyone can write to Storage | st-open-write | Storage | Critical |
| The {allPaths=**} match is open | st-recursive-wildcard-open | Storage | Critical |
| Any signed-in user can write to Storage | st-auth-only-write | Storage | High |
| Storage rules did not parse | st-parse-error | Storage | Info |
| The whole database is readable by anyone | db-root-read-open | Realtime Database | Critical |
| The whole database is writable by anyone | db-root-write-open | Realtime Database | Critical |
| A node is readable by anyone | db-open-read | Realtime Database | Medium |
| A node is writable by anyone | db-open-write | Realtime Database | High |
| A child rule is overridden by its parent | db-cascade-override | Realtime Database | High |
| Any signed-in user can read or write the whole database | db-auth-only-root | Realtime Database | High |
| Realtime Database rules did not parse | db-parse-error | Realtime Database | Info |
Questions
What does the Firebase rules checker look at?
It reads the Firebase security rules you paste for Firestore, Cloud Storage and the Realtime Database and looks for rules that let anyone read or write, rules that only require a signed-in user, trusted client input and similar patterns.
Is my rules text stored?
No. The rules are processed in memory on Cloudflare’s network and discarded once the answer is sent. Nothing is saved or logged with the text.
How much can I paste?
Up to 48,000 characters in total across the three fields. If your rules are longer, paste the part you want checked.
Why can a public read rule be fine?
Some data is meant to be public, such as a product catalog or blog posts. In Firestore and Storage the checker counts an unconditional read as a medium problem and takes 10 points, because it cannot know whether the data is private. If the data is public on purpose, you can accept that cost. At the root of the Realtime Database it rates an open read higher.
What are test mode rules?
When you create a Firestore database in test mode, the console writes a rule that allows everything until a date, using request.time. Until that date anyone can read and write; afterwards everything is denied and the app breaks. Replace it with real conditions before launch.
How do Realtime Database rules cascade?
In the Realtime Database a rule that grants access applies to everything below it, and a child cannot take it back. A stricter rule on a child under a permissive parent never applies, which is why the checker reports it.
What does the grade mean?
It summarises only what the checks can read in the pasted text: a score from 100 minus a penalty for each failed check, set by the most severe problem that check found, and any critical problem is an F. A medium item can also be a heuristic that asks you to check by hand, because the text alone cannot show whether it is a real problem. An A does not prove the project is secure, because custom claims, App Check and the data itself are out of reach.