security-firebase-apk-scanner

To check an Android APK for exposed Firebase API keys, the scanner analyzes embedded Firebase data and storage settings. It parses extracted configuration files to assess API keys, project IDs, database rules, and storage bucket access for security assessments.

Firebase security misconfigurations found inside an APK include exposed API keys, insecure Realtime Database or Firestore rules, open storage bucket access, and flawed Authentication settings. The scanner reviews embedded google-services.json data to detect these risks.

Yes, you need to decompile an APK or perform manifest inspection before scanning for Firebase storage bucket exposure. The scanner requires artifact extraction to parse the embedded google-services.json or Firebase config data to assess keys and access rules.

Yes, you can use this scanner to review third-party Android apps for Firebase database rules. It is specifically designed for third-party app reviews, security audits, and incident investigations to surface insecure Realtime Database and Firestore access configurations.

Parsing google-services.json helps with Firebase compliance reviews by extracting embedded project IDs, database URLs, and API keys. Analyzing these configuration artifacts identifies exposed credentials and insecure access rules, enabling rapid remediation for secure app deployments.