firestore-rules-creation
Create Secure Firestore Rules
Firestore Rules can expose private data when access and validation logic are incomplete. This skill helps create structured rules with least-privilege access, schema checks, and security test scenarios.
Vor der Installation anhalten und eine Bestätigung anfordern.
Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.
Mit meinem Agent installieren
Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.
Review the Skillstore skill "firestore-rules-creation" from https://skillstore.io/skills/firebase-firestore-rules-creation.md and its manifest at https://skillstore.io/api/skills/firebase-firestore-rules-creation/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.
Agent-lesbare Ressourcen
Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.
Testen
„firestore-rules-creation“ wird verwendet. Create rules for private user profiles and public posts.
Erwartetes Ergebnis:
- Assumed data model for profiles and posts.
- Rules that limit profile access to the owner.
- Rules that allow public post reads without exposing profile PII.
- A list of assumptions and tests to run.
„firestore-rules-creation“ wird verwendet. Secure a likes counter on each post.
Erwartetes Ergebnis:
- A counter-update policy that limits changed fields.
- A consistency check for one like per user.
- A replay and batch-operation test checklist.
Sicherheitsaudit
Hohes RisikoStatic detections are false positives caused by Markdown code formatting, Firestore Rules interpolation syntax, and security-focused prose. No command execution, network access, reconnaissance, or credential exposure is present. One semantic issue remains: the guidance to prefer `read` can unintentionally grant both get and list access.
Bestätigte Sicherheitsbedenken (1)
Risikofaktoren
⚙️ Externe Befehle (50)
🌐 Netzwerkzugriff (1)
Diesen Bericht teilen & zitieren
Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.
Berichtslink kopieren
https://skillstore.io/skills/firebase-firestore-rules-creation/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown-Badge
[](https://skillstore.io/skills/firebase-firestore-rules-creation?utm_source=security_passport_badge)HTML-Badge
<a href="https://skillstore.io/skills/firebase-firestore-rules-creation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/firebase-firestore-rules-creation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Einbettungskarte
<iframe src="https://skillstore.io/embed/skills/firebase-firestore-rules-creation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Wissenschaftliche Zitate (APA · BibTeX · CFF)
APA-Zitat
firebase. (2026). firestore-rules-creation security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/firebase-firestore-rules-creation/audits/1BibTeX-Zitat
@techreport{firebase-firebase-firestore-rules-creation-2026,
author = {firebase},
title = {firestore-rules-creation security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/firebase-firestore-rules-creation/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "firestore-rules-creation security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "firebase"
date-released: "2026-09-11"
url: "https://skillstore.io/skills/firebase-firestore-rules-creation/audits/1"
identifiers:
- type: other
value: "skillstore:firebase-firestore-rules-creation:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore-Score
Warum dieser Score Evidenzvertrauen: MittelWas Sie erstellen können
Build a new application policy
Create a starting rules file for a new Firestore application with authenticated ownership and schema validation.
Protect collaborative data
Define safe editor, viewer, owner, and administrator permissions for shared documents.
Harden an existing rules file
Refactor existing rules and test for update bypasses, role escalation, data leakage, and unsafe counters.
Diese Prompts ausprobieren
Review this project and create a prototype firestore.rules file. List your data model assumptions and require authentication by default.
Create Firestore Rules for a posts collection. Authors can create, read, update, and delete only their own posts. Validate title, body, author ID, and timestamps.
Design Firestore Rules for a workspace application with owners, editors, and viewers. Keep role fields immutable for non-owners and validate every update.
Refactor these Firestore Rules and perform the full attack checklist. Check counters, state transitions, collection queries, PII separation, and batch consistency.
Bewährte Praktiken
- Provide real collection paths, field types, queries, and user roles before generating rules.
- Test rules in the Firebase Emulator Suite with allowed and denied requests.
- Review generated rules before deployment and repeat tests after each schema change.
Vermeiden
- Do not use generated rules unchanged when application requirements are uncertain.
- Do not store public profile data and private personal data in the same document.
- Do not grant broad read or write access merely to resolve permission errors.