Security Issues in Firebase Studio Code

The critical risk is Firestore security rules left in development mode (allow read, write: if true), which means all data is publicly accessible to anyone who knows your Firebase project ID. Client-side Firestore access with no server-side validation means any user can write arbitrary data. Firebase API keys are visible in the client bundle by design, so rules are the only security layer

Write production Firestore security rules that scope every read and write to the authenticated user (request.auth.uid). Enable Firebase App Check to ensure only your app can call Firebase APIs. Use Firebase Admin SDK in Cloud Functions for operations that need elevated access. Enable email verification and enforce it before allowing data operations

Every Firebase Studio app needs authentication — verifying who the user is — and authorization — verifying what they're allowed to do. Check that every API route and server action verifies the user's identity before processing requests. Check that users can only access their own data. A common Firebase Studio pattern is adding auth to the UI but not the API, which means anyone with the endpoint URL can access data directly.

Never trust data coming from the client. Every form submission, URL parameter, and API request body should be validated server-side before processing. Use a schema validation library like Zod to define expected shapes and reject anything that doesn't match. This prevents injection attacks, data corruption, and unexpected crashes.

Configure security headers to protect against common web attacks: Content-Security-Policy to prevent XSS, Strict-Transport-Security to enforce HTTPS, X-Frame-Options to prevent clickjacking, and X-Content-Type-Options to prevent MIME sniffing. Most hosting platforms let you configure these in a headers file or configuration.

If your app handles user data, processes payments, or stores sensitive information, a professional security review is essential before launch. Our security scan ($19) checks for the most critical vulnerabilities, and our full security review service provides a comprehensive assessment with remediation guidance.