I scanned my own production project last week and found 17 publicly readable records I had no idea about. users, orders, internal admin documents — exposed via match /{doc} or allow read:if true rules. I'll do the same scan for yours.
ALTER TABLE … ENABLE RLS, REVOKE ALL ON … FROM anon, ALTER FUNCTION … SET search_path. Paste into the Supabase SQL editor.BEGIN; … ROLLBACK; first to verify, then commit.Firebase ships with locked rules for new projects but old ones still have the permissive testMode rules. Audit before they expire and break, or worse, leak.
I built and shipped firebase-security-skill (open source MIT) — the only auditor with active anon-key probe + MCP server for AI coding agents. SaaS competitors charge $49–499/month for what's essentially metadata reads. This is the manual + faster version of that, run by me directly.
What permissions do you need? your Firebase service account JSON (revoke 30s after). Read access is enough — the auditor never writes to your project.
Will you keep the token? No. Used only for the audit run. Deleted from my machine after the report is delivered. You can rotate it the moment you receive the report.
What if you find nothing? Money-back. I've never run this on a project that's been live >6 months and found zero issues, but if it happens to you, you don't pay.
Do you offer the fix too? The report ships with copy-paste SQL on every finding. If you want me to apply the fixes for you, that's a separate $199 add-on (we'll discuss after you see the report).
I'd rather just use the open-source tool. Go ahead — github.com/Perufitlife/firebase-security-skill. The $99 saves you the install + interpretation + writing the executive summary for your team. Worth it for some, not for others.