Does your Firestore rules file actually hold?
Paste it below. This flags the mistakes that show up again and again in real projects, the ones Firebase will never warn you about because your app keeps working either way.
Nothing leaves this page. Every check runs in your browser. There is no
server, no upload, no analytics, no network request of any kind. View source and
confirm it yourself, the whole tool is one file.
What it looks for
- CriticalOpen rules.
if true, or a leftover test-mode rule with an expiry date. - CriticalSigned in is not the same as authorised.
if request.auth != nulllets anyone who can click Sign Up read the collection. - CriticalRoot catch-all. A
match /{document=**}at the top level that grants anything. - WarningThe nested wildcard trap. A recursive wildcard matches zero or more segments, so it also matches its own parent document and quietly overrides the rules above it.
- WarningNo page-size brake. Firestore has no spending cap. Without
request.query.limit, one query can read a whole collection. - WarningClient-writable privilege. Roles, memberships, billing and credits that the client can write to.
- WarningUnfrozen ownership. An update rule that checks the owner but lets the owner field itself be rewritten.
- NoteCoarse grants.
allow read, writecovers five operations at once, including list and delete. - NoteBilled lookups. Every
get()andexists()inside a rule is a charged document read, evaluated per document. - NoteLegacy version. A missing or v1
rules_version.
Found something? The fixes are written and tested.
Firestore Rules Kit is seven production rule patterns covering the shapes real apps have, each proven by an automated test suite that asserts both what must be allowed and what must be denied. 94 assertions, running on the free local emulator. This checker finds the problem; the kit is the worked answer.