Firebase fixes
15 guides include a Firebase section. This page only lists those sections. It is not a copy of the full catalog, and a sponsor does not change which guides appear or their order.
- criticalUpdated Oct 12, 2026
Auth checked only in the UI in Firebase
Security rules are the enforcement point. A React route guard is not.
- criticalUpdated Oct 12, 2026
Exposed .env files and debug endpoints in Firebase
A downloaded service account JSON in the repo or in public/ is a server credential. Rotate it in Google Cloud credentials if it was exposed.
- criticalUpdated Oct 12, 2026
Firebase rules left open in Firebase
Scope each collection to the owner, and block fields the user must not set.
- criticalUpdated Oct 12, 2026
IDOR: reading or changing someone else's data in Firebase
In rules, compare request.auth.uid to the owner field on the document. request.auth != null only proves the caller is signed in.
- criticalUpdated Oct 12, 2026
Open storage buckets in Firebase
- criticalUpdated Oct 12, 2026
Secret keys shipped in the frontend in Firebase
The Firebase web config (apiKey, projectId, and similar) is designed to live in the client. Security rules are the control.
- criticalUpdated Oct 12, 2026
Server Actions with no auth check in Firebase
If the action uses the Admin SDK, rules will not stop it. The session check in the action is the control.
- criticalUpdated Oct 12, 2026
Supabase tables without row level security in Firebase
Firestore does not have Postgres RLS. The same class of bug is an open rules file.
- criticalUpdated Oct 12, 2026
The client sets the price, role, or plan in Firebase
- highUpdated Oct 12, 2026
CORS wide open in Firebase
The Firebase client SDK is meant to run in the browser. Rules decide access.
- highUpdated Oct 12, 2026
Cross-site scripting (XSS) in Firebase
Same rendering rules. Security rules do not stop XSS.
- highUpdated Oct 12, 2026
Prompt injection in LLM features in Firebase
Same pattern. Security rules must hold even if a Cloud Function trusts a model.
- highUpdated Oct 12, 2026
SQL injection in Firebase
You do not fix this with a SQL driver because Firestore queries are structured. You still must not let the client decide which collection to read.
- highUpdated Oct 12, 2026
Unsafe file uploads in Firebase
Storage rules should require request.auth.uid to match the path, limit request.resource.size , and check request.resource.contentType against your list. allow read, write: if true is the open-bucket bug.
- highUpdated Oct 12, 2026
Weak password reset in Firebase
Use sendPasswordResetEmail from the Firebase client SDK, or the Admin SDK's generate-link API if you send the mail yourself. If you send it yourself, the link still has to be the one Firebase generated.
How an entry gets onto a platform page is described in the editorial standards.