CheckVibeCodeCheckVibeCode
Checks/Configuration
ConfigurationLive — auto-discovered5 checks

Firebase Security Scanner

Check Firebase Security Rules, authentication settings, and Firestore/RTDB access controls.

Run this scanSee pricing

How this scan works

  • Auto-detects firebaseConfig (projectId, apiKey, storageBucket) from the homepage and its JS bundles
  • Unauthenticated GET against the Realtime Database (<project>.firebaseio.com/.json) — any non-null, non-permission-denied response flags open read rules
  • Unauthenticated Firestore REST reads across six common collection names — a returned document set flags open Firestore rules
  • Unauthenticated Storage bucket listing check against the real storageBucket
  • Probes the browser Web API key against Identity Toolkit (accounts:createAuthUri) — an accepted call means the key is unrestricted and enables email/user enumeration

More checks in Configuration

Security Headers ScannerSSL/TLS Security ScannerCookie & Session Security ScannerMobile Interface ScannerContainer & IaC Misconfiguration ScannerSupabase Security Scanner