Your app uses Firebase: what that means
Whether your app includes a Firebase configuration, the settings that tell the browser which Firebase project to use.
Why it matters
The Firebase config is meant to be public, so this is not a leak. It does mean anyone can talk to your Firebase project directly from their browser, so Firestore, Realtime Database and Storage security rules are what keep your data private.
How a survey checks it
Passive check: part of every free survey.
We look for the Firebase configuration in your homepage and its scripts. This is reported for information only; we do not contact your Firebase project.
How to fix it
- Review your Firestore, Realtime Database and Storage rules, and replace any "allow read, write: if true" or test-mode rules before launch.
- Require signed-in users for anything private, and check that rules compare the user's id with the data they ask for.
Prefer us to do it? Ask for a fix quote
Common questions
Should I hide my Firebase API key?
You cannot hide it from a web app, and you do not need to. Restrict the key in Google Cloud to your domains if you like, but the security rules are what protect your data.
What are test-mode rules?
Rules that let anyone read and write everything, often set up for a quick start. They are meant to expire or be replaced before launch.