Skip to content
ShipSecurelySecurity reference
Menu

13 tools · 88 fixes · 22 incidents tracked · Updated Oct 13, 2026 · Sources: Supabase, GitHub, OWASP, Stripe + 9

Firebase

Weak password reset in Firebase

highUpdated Oct 12, 2026

Use sendPasswordResetEmail from the Firebase client SDK, or the Admin SDK's generate-link API if you send the mail yourself. If you send it yourself, the link still has to be the one Firebase generated.

Fix for Firebase

Use sendPasswordResetEmail from the Firebase client SDK, or the Admin SDK's generate-link API if you send the mail yourself. If you send it yourself, the link still has to be the one Firebase generated. Do not invent a second code and store it in Firestore with rules that let anyone read the codes collection.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Firebase fixes are on the Firebase page.