Attackers can read, alter, or delete Firebase data when deployed Security Rules grant too much access; they can also abuse authentication flows or drive unwanted service traffic and cost. A Firebase configuration object or service API key visible in a web or mobile app is not, by itself, evidence of a breach: rules, authentication, IAM, App Check, and monitoring determine what a request can actually do.
What a Firebase misconfiguration can let someone do
The impact depends on the Firebase service, the requester’s identity, and the permissions in force. A rule that allows reading does not necessarily allow writing, and an authentication weakness is different from an open database.
As an Amazon Associate I earn from qualifying purchases.
| Service or path | Access condition | Possible operation | Potential consequence |
|---|---|---|---|
| Cloud Firestore | Unauthenticated or authenticated caller matches an overly broad deployed rule | Read, modify, or delete data, depending on the rule | Exposure of records or loss of data integrity. Firebase warns that without authentication and configured rules, someone who guesses a project ID can steal, modify, or delete data (Firestore guidance on insecure rules). |
| Realtime Database | Caller is covered by a permissive rule at the requested path or an ancestor | Read or write data, subject to the separate rule permissions | Unauthorized disclosure or changes; grants can apply to descendants (Realtime Database Security Rules documentation). |
| Cloud Storage | Storage rules permit an overly broad request | Access or change stored files, as allowed by the rules | Exposure or unwanted changes to user uploads or other objects. Storage rules must be reviewed independently of database rules (Firebase security checklist). |
| Firebase Authentication | Requests can reach project authentication endpoints; quotas or expected traffic are not appropriately bounded | Make authentication requests | Abuse of sign-in flows or unexpected load. A project API key can be used to make authentication requests, even though it does not authorize database or Storage access (Firebase API key guidance). |
| Cloud Functions and other backend services | Abusive request volume reaches a service or causes it to scale | Generate traffic and trigger processing | Service disruption or unexpected cost; Firebase specifically warns that Cloud Functions scaling during an attack can create a large bill (Firebase security checklist). |
These are possible failure modes, not a claim that Firebase apps are inherently vulnerable. The same project may have different controls across Firestore, Realtime Database, Storage, Authentication, and Functions.
Does a public Firebase API key expose a database?
Usually, no. Firebase service API keys identify a project or app; they are not the authorization mechanism for Firestore, Realtime Database, or Cloud Storage. Firebase says client-visible keys used only for Firebase services can appear in client code when configured appropriately. Client access to those services is controlled by Security Rules, while privileged Google Cloud access is governed by IAM and App Check can help limit requests to attested apps. See Firebase’s API key guidance.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The important exception is that an exposed Firebase key may be used to make authentication requests against that project. For password-based Authentication, Firebase recommends tuning Identity Toolkit quotas to expected traffic. A quota set too low can also cause legitimate sign-ins to fail as usage grows, so it should be based on expected demand rather than simply minimized.
Do not confuse a Firebase client configuration with a private credential. Service-account private keys and legacy FCM server keys are sensitive and should not be embedded in public client code. Use separate, restricted keys for other Google APIs rather than relying on a Firebase service key for those APIs.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
How rules fail in real applications
Public or overly broad reads
If deployed rules permit public reads, a caller may retrieve records the app intended to keep private. A project ID is not a secret boundary. Firebase’s warning is explicit: without user authentication and configured rules, someone who guesses the project ID can steal, modify, or delete data (Firestore insecure-rules guidance).
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Writes that are broader than reads
Read and write permissions are separate concerns. A project can expose data, permit unwanted changes, or both. In Realtime Database, rules govern read and write separately, and a grant at a higher path can apply to deeper paths. Review the hierarchy rather than assuming a narrow-looking child path is protected (Realtime Database rules documentation).
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Authentication without ownership checks
Authentication tells the service who is making a request; it does not automatically prove that person owns the requested record. A rule that checks only whether someone is signed in can still allow one user to access another user’s data. Rules need to compare the authenticated identity with the relevant record or path and constrain which changes are allowed. Firebase explains this distinction in its guide to Security Rules and Firebase Authentication.
Rules that look narrow but match more data
In Firestore, a broad grant on a higher matching path can permit access throughout the matched hierarchy. In Realtime Database, read and write permissions cascade to descendants. Review the deployed rules for each service—not only local files, comments, or the behavior the app’s interface appears to enforce. Firebase’s Security Rules guide explains the rule model, and its Firestore guidance describes insecure rule patterns.
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
How common are open Firebase databases?
A 2021 study by the Gen Digital Threat Research Team reported that 10.7% of approximately 19,300 tested Firebase databases were open to unauthenticated users. The researchers said they had identified about 180,300 Firebase addresses, tested approximately 19,300 databases, and conducted the study at the end of July 2021. They explicitly did not test write access. This is a historical result for that sample, not a current global rate or evidence that 10.7% of Firebase databases allow writes. Read the study’s scope in the Gen Digital report.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →How to audit and secure a production Firebase project
- Inventory every production project and service. Identify which project each deployed app instance uses, then review Firestore, Realtime Database, and Storage separately. Development and production should use environment-specific Firebase projects, with each app instance pointed at its matching project (Firebase security checklist).
- Inspect the rules that are actually deployed. Check every relevant database and Storage ruleset. Look for public grants, broad path matches, read permissions that expose more records than intended, and write or delete permissions that exceed the app’s needs. Verify hierarchy and inheritance behavior for the specific service (Rules getting-started guide).
- Start from deny-by-default and grant only required access. Define which users or app states need access to each data class, then grant only those operations. Firebase recommends beginning with restrictive rules and adding specific grants as the data model develops. Its checklist summarizes the practice: “Security rules are a schema; add rules when you add documents.” (Firebase security checklist).
- Bind authorization to the requested record. Use Authentication to identify a requester, then make rules enforce whether that identity can read or change the particular record. Limit writable fields or operations where the application’s needs call for it; a sign-in check alone is not an ownership check (Rules and Authentication guide).
- Test rules before release. Use the Console Rules Simulator for quick checks and the Local Emulator Suite for a fuller local validation workflow. Include rule tests in CI so changes to the data model or rules do not silently broaden access. Firebase recommends emulator-based rule validation in its security checklist and documents the rules workflow in Get started with Firebase Security Rules.
- Roll out App Check deliberately. App Check can attest that requests come from registered apps and, when enforcement is enabled for a supported product, reject unverified requests. Review metrics before enforcing it so you can understand the effect on legitimate users. It is an additional layer, not a replacement for Authentication or rules (Firebase App Check; enforcement guidance).
- Set monitoring and cost alerts. Watch Firestore, Realtime Database, Storage, Hosting, and expected Cloud Functions traffic for unusual activity. Firebase recommends monitoring backend services and escalating suspected attacks through Firebase Support (Firebase security checklist).
- Review keys and privileged access separately. Keep service-account private keys and legacy FCM server keys out of client apps, restrict keys used for other Google APIs, and review privileged Google Cloud access through IAM. A client Firebase key is not a substitute for these controls (Firebase API key guidance).
What App Check can and cannot stop
App Check helps distinguish requests from registered apps from requests made by unverified clients. It can reject unverified requests for a supported product once enforcement is enabled, but it does not establish what an authenticated user is permitted to do; Security Rules still need to authorize access.
Best Value
- PHISHING-RESISTANT 2FA: Cryptographically binds to real domains, making phishing attacks impossible unlike SMS codes or authenticator apps.
- 3-SIDE CAPACITIVE TOUCH: Tap the end, left, or right side to authenticate, so it works in any orientation or crowded USB port.
- MULTI-COLOR LED INDICATOR: Blue means ready, blinking blue means tap now, green means success, and red means error for instant status feedback.
- IP68 WATERPROOF & BATTERY-FREE: Crush-resistant one-piece construction survives daily carry on a keychain or in a bag for years without any batteries.
- UNIVERSAL COMPATIBILITY: Works with Google, Microsoft, Apple, GitHub, AWS, and any FIDO2 / U2F / WebAuthn service, storing up to 100 passkeys.
App Check also cannot prevent every abuse of a legitimate app. Firebase gives the example of someone initiating, but not completing, login flows to generate SMS. For Firebase Authentication specifically, the documentation says App Check use requires upgrading to Firebase Authentication with Identity Platform. Check the relevant Authentication FAQ and enforcement instructions before enabling it.
What to do if you find an exposure
- Restrict the affected deployed rules to the minimum access the application needs, and verify the corrected behavior with rule tests.
- Review service activity and usage for signs of reads, writes, deletions, authentication requests, or traffic outside expected patterns; pay particular attention to services that can scale and affect cost.
- Check whether any sensitive credential—not merely a client-visible Firebase service key—was exposed. Review and secure privileged keys and access accordingly.
- Use Firebase Support to escalate a suspected attack, as recommended in the Firebase security checklist.
A client-visible Firebase key alone does not establish that data was accessed. The key question is whether deployed permissions or other exposed credentials allowed the activity, and what the service logs and usage show.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
