Access control and data isolation
Firebase rules still in test mode
The database or storage rules allow any client to read and write because the permissive development rules were never replaced.
Termsrow-level security (database rules that decide which rows each signed-in user may read or write) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server) · API (the interface other software calls; tested directly, without the UI in between)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Firebase's docs say clients access data directly and Security Rules are the only safeguard; test mode allows anyone in. Generated setups pick the mode that makes the first read succeed.
Firebase allows clients direct access to data, and Security Rules are the only safeguard; Locked mode denies all access by default while Test mode allows anyone access.
Source: Firebase docs, 2026-09 · verified 2026-09-21
How we detect it
Read the deployed rules; run the rules unit tests in the emulator as an anonymous client.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Stacks: Firebase
Checklist items that catch it
Firebase rules are out of test mode and covered by rules tests
tool Read the deployed Firestore, Realtime Database and Storage rules; run the rules unit tests in the emulator.
No rule grants read or write to all users without a condition; the rules test suite exists and passes.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in access control and data isolation
- critical
- critical
- critical
- critical
- critical
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.