# Build Secure Firebase Backends

Firebase simplifies backend development, but weak rules and inefficient data models create security and cost risks. This skill provides practical patterns for secure, scalable Firebase applications.

## Install

```bash
npx skillstore add sickn33/firebase
```

## Metadata

- Status: approved
- Slug: sickn33-firebase
- Skillstore revision: r2
- Version status: missing
- Tree hash: abe9690cb9b2024d8ae617e59f7280e77a46402515f5529106ba5dfbd06294ca
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/firebase
- Ref: 88a8e9a07f4c54ab105c1c41b6267c287146b07b
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network
- Quality score: 69
- Public page: https://skillstore.pages.dev/skills/sickn33-firebase
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-firebase/manifest

## Capabilities

- Design denormalized Firestore models around application queries.
- Draft Firestore security rules for ownership, public data, and administrative access.
- Implement Firebase Authentication with social providers, account linking, persistence, verification, and password recovery.
- Build Cloud Functions v2 for HTTP endpoints, document triggers, and scheduled tasks.
- Apply real-time listeners, batch writes, transactions, token refresh, modular imports, and emulator-based testing.

## Use Cases

- Build a real-time web application: Plan Authentication, Firestore queries, listeners, and cleanup for a responsive application with controlled read costs.
- Create serverless backend workflows: Design Cloud Functions for authenticated endpoints, Firestore triggers, scheduled maintenance, and atomic updates.
- Review Firebase access controls: Evaluate ownership checks, custom claims, public data boundaries, and emulator test scenarios before deployment.

## Prompt Templates

### Plan a Firebase application

```
Plan a Firebase backend for [application]. Include services, collections, authentication methods, core queries, security boundaries, and emulator tests.
```

### Design a Firestore model

```
Design Firestore collections for [requirements]. Map each query, explain denormalization choices, identify indexes, and estimate listener read behavior.
```

### Audit security rules

```
Review these Firebase security rules against [roles and permissions]. Identify unauthorized access paths and propose emulator tests for every rule.
```

### Optimize a production architecture

```
Assess this Firebase architecture for security, cost, scale, consistency, and failure handling. Prioritize changes and explain measurable validation steps.
```

## Limitations

- The guidance does not replace testing security rules against application-specific access scenarios.
- Advanced OAuth flows, payment processing, email delivery, and container deployment require specialized guidance.
- Firestore recommendations may not fit highly relational data or full-text search workloads.
- Example snippets require complete imports, environment configuration, and application-specific error handling before production use.

## Best Practices

- Design documents around known queries and indexes before implementing user interfaces.
- Test security rules with authenticated, unauthenticated, owner, non-owner, and administrator scenarios.
- Use emulators and monitoring to validate listeners, functions, read volume, and failure behavior before production deployment.

## Anti Patterns

- Do not use open read or write rules as a temporary production configuration.
- Do not attach unbounded listeners to large collections or leave subscriptions active after a view closes.
- Do not place privileged operations in clients because Firebase Admin SDK operations bypass security rules.

## Security Audit

- Audited at: 2026-07-23T22:16:54.135\+00:00
- Summary: Eight alerts are false positives caused by JavaScript template literals, Markdown backticks, and normal authentication response code. Two network findings are confirmed because the API helper sends current and refreshed ID tokens to an unrestricted URL. No prompt injection or malicious intent was found, but the client-written session cookie lacks standard cookie protections.

## Stats

- Views: 140
- Downloads: 9
- Favorites: 0
- Popularity score: 0