Firestore Security Rules Auditor

firebase/agent-skillsOfficial

This takes a red team approach to auditing Firestore security rules, specifically looking for the kinds of bypasses that actually happen in production. It checks for the classic create/update split where users bootstrap valid documents then mutate them into privileged states, sniffs out rules that trust client-provided role fields, and flags missing size limits that let attackers stuff documents until you hit quota. The field-level versus identity-level distinction is smart: it catches rules that restrict which fields change but forget to check who's changing them. If you're shipping anything with user-generated Firestore data, running this before launch will save you from the "wait, users can just set isAdmin to true?" postmortem.

installs

20.4K

GitHub stars

490

last updated

Aug 21, 2026

Sponsors

SnugThe clipboard manager you and your agent can use, safelyAgent CaffeineClose your lid, come back to finished workWaxBlock anything with supervision, without erasing your iPhoneOpen StepsSponsoredFree and open-source skills that make AI coding agents easier to understand, verify, and control.