---
name: rt-exploit-firebase
description: "Authorized Firebase security assessment skill for Firestore, Realtime Database, Storage, Authentication, Cloud Functions, API key exposure context, App Check, and remediation."
---

# rt-exploit-firebase - Firebase Security Assessment

## Overview

Firebase risk usually comes from permissive security rules, weak role modeling, exposed storage, callable functions, missing App Check, or misunderstanding API keys. This skill reviews Firebase posture without treating every API key as automatically critical.

## Prerequisites

- Firebase project IDs and apps in scope.
- Test accounts for each role.
- Approved test collections/buckets.
- Rules export or console access if provided.
- Agreement on data sampling limits.

## Assessment Areas

| Service | Key Checks |
|---|---|
| Authentication | Sign-up policy, providers, email verification, custom claims. |
| Firestore | Rules, document ownership, collection group access, query constraints. |
| Realtime Database | Read/write rules, validation rules, anonymous access. |
| Storage | Object permissions, metadata exposure, direct download URLs. |
| Cloud Functions | Callable auth checks, secrets, CORS, rate limits. |
| App Check | Enforcement for app/API abuse reduction. |
| API Keys | Restrictions, quota, and actual abuse path. |

## Workflow

1. Identify project ID, app IDs, and exposed endpoints.
2. Review security rules against role model.
3. Validate only with test documents and accounts.
4. Check storage object permissions and signed URL patterns.
5. Review cloud function auth boundaries.
6. Map misconfigurations to business data exposure.

## Evidence

Capture rules excerpts, test account role, test document path, expected result, observed result, and redacted screenshots. Avoid reading production user data.

## Remediation

- Deny by default.
- Enforce owner/role checks in rules.
- Add rules unit tests.
- Enable App Check for abuse-sensitive apps.
- Restrict API keys where appropriate.
- Move privileged logic to trusted server/cloud functions.
- Monitor suspicious reads/writes and quota spikes.

