Firebase pre-launch checklist
Defaults referenced come from Google's documentation, verified 2026-09-21, on the Firebase hub.
Secrets and keys
- CriticalSecrets committed to the code repository
Open your project on GitHub (or the code view in your builder) and look at the file list for
.env,.env.local,.env.production,serviceAccountKey.jsonorfirebase-adminsdkfiles. - HighThird-party API key in the JavaScript bundle
Open your live app in Chrome, right-click, choose Inspect, then open the Sources tab.
- HighSecrets and internals in error messages and logs
Open your live app, right-click, choose Inspect, then the Network tab. Trigger an error on purpose: submit a form with a field left blank, or visit an address like
/api/anything-made-up.
Data access
- CriticalFirebase rules left in test mode
Open the Firebase console, choose your project, then Firestore Database (or Realtime Database, or Storage) and open the Rules tab.
- CriticalRecord ids accepted without an ownership check
Create two accounts in your app and add one record, such as an order or a note, in each.
- CriticalAny signed-in user can read every row
In the Supabase dashboard open Authentication, then Policies. Row Level Security (RLS) is the per-row access rule set Postgres applies to each query, and this page shows each policy's expression.
- HighUploaded files in a public storage bucket
In the Supabase dashboard open Storage and look for the Public label on each bucket; in Firebase open Storage, then the Rules tab.
Login and permissions
- CriticalAdmin routes without any login check
Open a private browsing window so you are signed out.
- CriticalAuthorization enforced only in the browser
Sign in as a normal user and open developer tools (right-click, Inspect), then the Network tab.
- CriticalDefault admin credentials left in place
In the builder's code view, search the whole project for admin@, password, seed and demo.
- CriticalTokens trusted without server verification
Sign in, open developer tools (right-click, Inspect), go to the Network tab and pick a request to your own API that carries an Authorization header or a session cookie.
- CriticalRole chosen by the client at signup
Open your signup page, open developer tools (right-click, Inspect) and the Network tab, then submit the form with a test email.
- HighSessions that survive logout and password changes
Sign in, open developer tools (right-click, Inspect), go to the Network tab and use Copy as cURL on a request that returns your account data.
AI features
- CriticalNo output validation before actions
List the things your AI feature can do beyond replying with text: run queries, call APIs, send messages, change records, fetch URLs, run code.
Deploy and config
- CriticalAI agent with production credentials
Open the folder the agent works in and look for .env, .env.local or similar files; note whether any value starts with sk_live_, contains the word prod, or is a service-role or admin key.
Mobile
- CriticalSecrets in the mobile app bundle
Open the project's .env files and app.json or app.config.js; list every variable whose name starts with EXPO_PUBLIC_ or that sits under extra.
- HighOffline state corrupting data
On two phones (or a phone and the simulator) signed into the same account, put one in airplane mode and edit the same record on both.
Payments
- HighSubscription state trusted from local storage
Sign in to your app with a free account, press F12 to open developer tools, select the Application tab, then Local Storage on the left.
Reliability
- HighNo rate limiting on sensitive routes
Open your app's login or "forgot password" page in Chrome, press F12 and choose the Network tab.
- MediumBackground jobs that fail silently
List every scheduled or background task your app has: on Vercel open Settings then Cron Jobs; on Supabase open Integrations then Cron, and Edge Functions; on Replit look for a Scheduled deployment.
- MediumErrors swallowed, spinner never stops
Open your app in Chrome and sign in as a normal user.
Data integrity
- HighDeletes with no soft delete or audit trail
In a test account, create a record in the app, then delete it using the app's own button.
- HighNo backup that has ever been restored
Open your database provider's dashboard and find the backups page (Supabase: Database, then Backups; Replit: the Database tool, then restore options).
- HighRace conditions on counters and balances
Open the app in two browser tabs signed in to the same test account that has a limited balance, seat count or single-use coupon.
Performance
- MediumOne database query per list item
Open a page in your app that shows a list (orders, projects, customers) in Chrome, press F12, choose the Network tab and filter by "Fetch/XHR".
- MediumList endpoints that return everything
Open your app's main list page in Chrome, press F12, choose the Network tab, filter by "Fetch/XHR" and reload.
- MediumWhole table downloaded, filtered in the browser
Sign in to your app as a normal user, open a page that lists your own items, press F12, choose the Network tab, filter by "Fetch/XHR" and reload.
Questions
firebase security checklist
The list above: 27 checks across 10 categories, most severe first. Each links to a page with what the issue looks like, a self-check and a fix direction. Download the Markdown file to tick items off in your own notes.
can i use this checklist without buying anything
Yes. That is the point of publishing it. If you run every self-check and fix what you find, you have done most of what the security sweep does. What our test adds is a second account, scripts that enumerate everything, and a written report you can show someone.
Prefer someone else to run it: the security sweep covers the critical items in 24 hours; the pre-launch check covers the full list. Or run the self-check tool.