firebase-security-rules-auditor

What problem does it solve? Firestore security rules often look correct but contain subtle holes—update bypasses, self-assigned roles, missing type checks—that expose data or allow privilege escalation. This Skill systematically audits your rules from an attacker's perspective so vulnerabilities are caught before deployment. ## Core Features & Use Cases - Red Team Audit Checklist: Evaluates rules against six mandatory checks including update bypasses, authority source validation, business logic alignment, storage abuse limits, type safety, and field-level versus identity-level security. - Scored Findings: Assigns a 1-5 security score (Critical to Secure) and returns structured JSON findings with severity, issue description, and concrete fix recommendations. - Admin Bootstrapping Awareness: Correctly handles hardcoded admin email patterns without penalizing them when email verification and escalation safeguards are in place. - Use Case: After generating or updating Firestore rules for a collaboration app, run this audit to discover that collaborators cannot actually read shared data, or that any authenticated user can update another user's document fields. ## Quick Start Audit my Firestore security rules in firestore.rules and report any vulnerabilities with a security score and recommended fixes.