Skip to content

Add firebase-security-skill (MIT auditor for Firestore/RTDB rules)#94

Open
Perufitlife wants to merge 1 commit into
jthegedus:mainfrom
Perufitlife:add-firebase-security-skill
Open

Add firebase-security-skill (MIT auditor for Firestore/RTDB rules)#94
Perufitlife wants to merge 1 commit into
jthegedus:mainfrom
Perufitlife:add-firebase-security-skill

Conversation

@Perufitlife
Copy link
Copy Markdown

Adding firebase-security-skill to the Other section.

It's an MIT-licensed auditor that probes anonymously to confirm:

  • Firestore security rules with allow read: if true patterns
  • Realtime DB rules permissive across paths
  • Public Storage buckets with broad read access
  • Weak auth provider configurations (anonymous sign-in left enabled, no email verification, etc.)

I scanned 77 random Firebase projects from public GitHub commits — 22% leaked user data anonymously (writeup: perufitlife.github.io/supabase-security-skill/blog/scanned-100-supabase-projects.html).

Hosted run on Apify (no install): apify.com/renzomacar/firebase-security-auditor.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant