Is my Firebase database public?

By Shinobi Tech, the team behind AppLeakWatch. Updated .

It's public if your security rules allow reads without a login. Your Firebase config is meant to be visible, so the rules are the only thing protecting your data. Test mode rules and rules like "allow read: if true" need replacing before launch.

Why this happens

Rules written for quick testing tend to stay in place, because everything keeps working. Strangers can read your config from your site and query your database directly.

How to check

  1. Test your own Realtime Database while signed out:
    curl "https://PROJECT-default-rtdb.firebaseio.com/.json?shallow=true"
  2. A permission denied error is good. Real data or a list of keys means it's open.
  3. In the Firebase console, read your Firestore and Storage rules and look for allow read, write: if true.

How to fix it

  1. Limit each user to their own records in Firestore:
    match /users/{userId} {
  allow read, write: if request.auth != null
    && request.auth.uid == userId;
}
  2. Test with the rules simulator in the Firebase console.
  3. Lock down Storage rules too. They're separate.

Prompt for your AI tool

Rewrite the Firebase security rules for Realtime Database, Firestore and Storage. Deny everything by default, then allow only what the app needs, with users limited to their own records. Show me the final rules and explain them.

Review what your AI tool changes, and test the live site afterward.

Catch this before a stranger does

AppLeakWatch keeps checking your live app and emails you when something new appears.

Start your 7-day trial

Common questions

Do I need to hide my Firebase API key?

No. It identifies your project and isn't a password. Your rules are what protect the data.

Can I test this without a login?

Yes. An outside test like the curl above shows what a stranger gets.

Related guides