rules-firebase

Firebase Admin SDK initialized without explicit credentials — CWE-285. Calling admin.initializeApp() with no arguments relies on Application Default Credentials, which may not be scoped correctly in CI/CD or local dev environments, potentially granting broader permissions than intended. Pass an explicit credential: 'admin.initializeApp({ credential: admin.credential.applicationDefault() })' or a service account credential.

firebase.database() uses the compat (v8) Firebase SDK which is deprecated. Migrate to the modular SDK (v9+): import { getDatabase } from 'firebase/database'. The modular SDK is tree-shakeable, receives security patches, and will eventually replace the compat shim.

Hardcoded Firebase API key in source — CWE-798. While the Firebase Web API key is technically public-facing, embedding it in committed source alongside a weak security-rules configuration means anyone with the key and no-auth rules can access your data. Store the config in environment variables and keep security rules tight. For server-side usage, never use the Web API key — use a service account credential.

Firestore security rule allows unauthenticated read for all documents — CWE-284. 'allow read: if true' gives every internet user access to the entire collection. Restrict to 'allow read: if request.auth != null' or a more specific condition.

Firestore security rule allows unauthenticated write for all documents — CWE-284. 'allow write: if true' lets anyone on the internet create, modify, or delete any document in the collection. Restrict to authenticated and role-checked writes.

Firebase Realtime Database security rule grants unauthenticated access — CWE-284. Setting '.read' or '.write' to literal 'true' at the root exposes the entire database to anonymous reads or writes. Restrict to authenticated users: '"read": "auth != null"'.

Firebase service account private key in source — CWE-798. A committed service account JSON gives any reader full admin access to your Firebase project (Firestore, Auth, Storage, etc.) bypassing all security rules. Remove immediately, rotate the key in Google Cloud IAM, and load credentials from the runtime environment or Secret Manager.