Can anyone read your Firebase database?

Firebase keeps your data safe only if your security rules say so. AI tools often leave them open. Paste yours and read each rule in plain English, then test your live project from outside.

  • Plain English for every rule
  • Catches test mode, open reads and missing owner checks
  • Firestore and Realtime Database
  • Runs in your browser, nothing is sent to LogicTrail

1. Read your rules

Where do I copy my rules from?

Open your project in the Firebase console. For Firestore (the database most apps use), go to Firestore Database, then the Rules tab. For the older Realtime Database, go to Realtime Database, then Rules. Copy everything in the editor and paste it above.

If your app has a firestore.rules or database.rules.json file, that works too. But the console shows what is really live.

Runs in your browser. Nothing you paste is sent to LogicTrail.

2. Test it from outside

This asks your live project for data the way a stranger would: not signed in, with nothing but your project ID. It only reads, and shows names, never your data.

Find it in the Firebase console under Project settings, or as projectId in your app's Firebase config. If your Realtime Database is outside the US, paste its full URL from the Realtime Database page.

A collection is a named group of documents, like users or orders. Leave this empty to try common names.

Runs in your browser, straight to Firebase. Nothing is sent to LogicTrail.

The rules AI tools write

Your Firebase project ID sits inside your app for anyone to read. That is fine: it is not a secret. Your security rules are the only thing that decides who can read and change your data.

Test mode, allow read, write: if request.time < timestamp.date(…), opens the whole database to everyone until a date, then shuts it. AI tools pick it to make errors go away, and it stays live.

if true, or allow read; with no condition, means everyone. On /{document=**} it means everyone, everywhere. Firebase lets a request through when any rule allows it, so one open rule beats all your careful ones.

request.auth != null only means "signed in". Anyone can sign up, so every user can read every other user's data. Ownership needs request.auth.uid == userId.

No field checks on create and update let a user save anything, such as role: "admin" or a thousand free credits.

A safe pattern

  1. Keep each user's data in a document named after their user id, like /users/{userId}.
  2. Remove any test mode rule and any rule on /{document=**} that says true.
  3. Allow reads and writes only when request.auth.uid == userId.
  4. On create and update, list the fields a user may set with request.resource.data.keys().hasOnly([…]).
  5. Publish, then paste the rules here and test your project from outside.
match /users/{userId} {
  allow read, update, delete: if request.auth != null
    && request.auth.uid == userId;
  allow create: if request.auth != null
    && request.auth.uid == userId
    && request.resource.data.keys().hasOnly(['name', 'photo']);
}

Each rule should read "only their own documents". Anything shared, like a product list, can be read-only for everyone, with writes left to your server.

Questions

Where do I find my Firebase rules?
In the Firebase console, open your project. For Firestore, go to Firestore Database and the Rules tab. For Realtime Database, go to Realtime Database and Rules. Copy everything in the editor. A firestore.rules or database.rules.json file in your code works too, but the console shows what is live.
Is it safe to paste my rules and project ID here?
Yes. Rules contain no keys or data, and the reader runs entirely in your browser. The outside test goes from your browser straight to Firebase, reads only, and shows names, never values. Nothing reaches LogicTrail.
What is test mode, and why does my app break after 30 days?
When you create a database in test mode, Firebase writes a rule that lets anyone read and write everything until a date about 30 days away. Until then your data is public. After it, every request is refused and your app stops working. Do not push the date forward: replace it with owner-only rules.