Browse categories
Explore
Fiverr Pro
English
$
USD
I will audit and fix your firebase firestore security rules
Horokhovskyi A
About this gig
Firebase's starter rule is "allow read, write: if request.auth != null". It means every signed-in user can read every document in your database, including other customers' data. Most apps launch this way and never find out.
WHAT I CHECK
- Read and write scope per collection: who can actually see what
- Tenant isolation: can customer A query customer B's records
- Privilege escalation: can a user write their own admin role document
- Server-side auth: do your API routes verify the ID token, or trust a userId sent by the client
- Admin SDK routes that bypass your rules entirely
- Service account and API keys leaking into the client bundle
- Query patterns and missing indexes that will break, or bill you, at scale
WHAT YOU GET
A ranked report, critical to nice-to-have, in plain English. Each finding names the exact rule or line of code and the fix. On Standard and Premium I write the rules, deploy them, and hand you emulator tests you can re-run, so a later change can't silently reopen the hole.
BACKGROUND
I've hardened Firestore rules for 7 production apps, including a multi-tenant platform where every collection is scoped by company.
Supabase RLS audits: same scope, same price.
Respect third-party rights
Please be aware that it is against Fiverr's policies for sellers to include themes, templates, or any other elements that infringe third-party rights or applicable laws in the delivered work. Read more about in our Guide to Responsible Digital Creation.
Get to know Horokhovskyi A
Horokhovskyi A
FullStack AI Developer NextJS Firebase LLM Integrations
- FromPortugal
- Member sinceMar 2024
- Avg. response time1 hour
Languages
English, Ukrainian, Russian
I take AI-generated apps to production.
I've shipped 7 full-stack products on Next.js + Firebase: an AI recruitment CRM with 17 tool-calling functions, a multi-tenant retail platform, an LMS with live WebRTC lessons, an AI journaling app with client-side encryption.
So I know exactly where Lovable, Bolt, Base44 and Cursor builds break — Firestore rules that let anyone read everything, auth guards that loop, API keys in the client bundle, builds that "pass" because TypeScript errors are silenced.
Send me your repo. Free diagnosis in 24h.
My Portfolio
FAQ
Do you need my production credentials?
No. I need read access to the repo and your rules file. For Standard and Premium I test against the local Firebase emulator, not your live project. You deploy the final rules yourself if you prefer.
How bad is it usually?
In most AI-generated apps I've looked at, any signed-in user can read the entire database. It's rarely carelessness — it's the default the tooling hands you, and nobody revisits it before launch day.
Can you prove the fix actually works?
That's what the emulator tests are for. Each one asserts that a specific user cannot do a specific thing. You run one command and watch them pass. If someone loosens a rule later, the test fails.
I haven't launched yet. Is this too early?
It's the cheapest possible moment. Fixing tenant isolation before you have customers is a config change. Doing it afterwards is a data migration with downtime.
Will this slow my app down?
No. Well-scoped rules usually make things faster, because they force query patterns that use indexes. If I find a rule that costs you reads, I'll say so and give you the cheaper shape.
