Stack · Google
Release testing for Firebase apps
Clients talk to the database directly and Security Rules are the only safeguard. Rules can be unit-tested in the emulator before they deploy; the checklist requires that they are.
Termsrow-level security (database rules that decide which rows each signed-in user may read or write) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back) · critical flow (a path a user takes that costs money or trust if it breaks: sign-up, checkout, invite, export) · verdict (a one-word release result (pass, pass with findings, fail) with the findings and the checklist version behind it) · CI (the pipeline that builds and tests every change before it can be merged or deployed) · client bundle (the JavaScript your app sends to the browser or ships inside the mobile app; anyone can read it)
What Firebase changes in a codebase
Clients talk to Firestore, Realtime Database and Storage directly. Security Rules are the whole authorization layer; App Check adds device attestation on top.
A Firebase project created in test mode for a demo ships open unless someone changes the rules. AC-06 reads the deployed rules and runs the rules test suite on every release, and AC-02's two-user test proves isolation on real data.
Defaults, from the docs verified 2026-09-21
| Default, from the docs | Why it matters for release testing | Source |
|---|---|---|
| "Firebase allows clients direct access to your data, and Firebase Security Rules are the only safeguard blocking access for malicious users." | There is no server between the client and the data unless you build one; AC-06 reads the deployed rules every release. | docs verified 2026-09-21 |
| "The default rules for Locked mode deny access to all users"; Test mode lets anyone access the data and must be replaced before launch. | A project created in test mode for a demo ships open unless someone changes it; AC-06 fails on any unconditional allow. | docs verified 2026-09-21 |
| Rules can be unit-tested with the Local Emulator Suite; "the v9 Rules Unit Testing library is always aware of the emulators and never touches your production resources." | AC-06's pass criterion requires the rules test suite to exist and pass in CI. | docs verified 2026-09-21 |
| App Check "helps protect your app backends from abuse by preventing unauthorized clients from accessing your backend resources"; enforcement is a separate step you enable. | App Check limits who can call; it does not decide what a caller may read. Rules still carry AC-02. | docs verified 2026-09-21 |
Each row was read on the linked page on the date shown. Docs change; the date tells you how current the row is. Firebase documentation.
Failure patterns most associated
- criticalAPI key shipped in the client bundle
A key meant for the server ends up in JavaScript the browser downloads, so anyone can read it and call the service as the app.
- criticalList endpoint returns other tenants' rows
A list or search endpoint filters by the wrong column or none, so a user sees records belonging to other accounts.
- criticalObject fetched by id without an ownership check
An endpoint checks that the caller is logged in, then returns whatever id was requested.
- criticalAdmin gate enforced only in the UI
The admin page hides its buttons from ordinary users, but the underlying route or action accepts calls from anyone logged in.
- criticalRole or flag read from the request
The server decides what a user may do from a role, plan or isAdmin value that arrived in the request body, query string or client state.
- criticalFirebase rules still in test mode
The database or storage rules allow any client to read and write because the permissive development rules were never replaced.
- criticalProtected route checked only in the browser
A redirect in client code hides the page from signed-out users while the data endpoint behind it answers anyone.
- criticalRegistration or verification endpoint usable without prerequisites
An endpoint in the sign-up or verification flow accepts calls out of order, so an account can be created or verified without the intended step.
How the checklist adapts
- AC-06 fails on any unconditional allow in Firestore, Realtime Database or Storage rules, and requires the rules unit tests to pass.
- AC-02 runs the two-user test against collections, not tables.
- App Check enforcement is recorded; it limits which clients can call but does not replace rules for what a caller may read.
- DM-02 and DR-02 cover exports and restores, since rollback of client-written data has no migration to reverse.
Release checklist, five of the published items
v1.0 · verified on 2026-09-21No secret keys in client bundles
automated Scan the built client assets (JS, source maps, HTML) for known key prefixes and for every value present in the server environment file.
Zero matches for key prefixes (sk_, service_role, AKIA, whsec_, private keys) and zero server-only env values found in client assets.
Public environment prefix carries only public values
manual List every variable with a client-exposed prefix (NEXT_PUBLIC_, EXPO_PUBLIC_, VITE_, REACT_APP_) and confirm each one is meant to be public.
Every client-prefixed variable is documented as public; no variable holds a key that can write or read beyond the anonymous role.
Policies deny cross-tenant reads and writes when tested as another user
automated For every table or collection, sign in as user A, create a row, then as user B attempt select, update and delete on it through the client API.
User B receives zero rows on select and a permission error on update and delete, for every table.
Object access checks ownership, not only login
automated For each endpoint or action that takes an id, call it as a logged-in user with an id owned by another user.
Every id-bearing endpoint returns 403 or 404 for a foreign id; none returns the object.
Admin functions are verified on the server
automated Call every admin route and admin server action as a regular user, with and without an admin flag set in the client state or query string.
Every admin route and action rejects the regular user regardless of client-side flags.
Which plan fits
Growth $5,900/mo
Growth when a mobile app is involved, which on Firebase is often; Starter for a web-only app.
For 8-15 engineers, daily releases, web plus API or one mobile platform. Limits, cadence and what is not included.
Questions
Firebase security rules testing
Firebase test mode rules expire production
Get a risk list for your codebase
5 business days, $1,200, credited to the first month.