Firebase rules in test mode
Scan rule · RSC-SEC-131
- Security
- Severity: High
- CWE-284
- OWASP A01-2021
Finds the time condition of Firebase test mode — `request.time < timestamp.date(…)` in `.rules` files or `"now < …"` in `database.rules.json` — as long as the date has not yet passed.
Why this matters
Creating a database in the Firebase console offers test mode: until a date 30 days out, anyone may read and write without signing in. For AI-built apps it is the most convenient start — and the condition looks harmless in code because it looks like a rule.
Once the date passes, Firebase denies everything and the app stops working. The obvious “fix” is to extend the date — which opens the database to everyone again. Fix: write real rules that bind access to the owner and test them against an anonymous call in the rules playground.
Scan tier
- Repo access (deep scan)
How to fix it
Replace the time condition with rules bound to `request.auth.uid` and the owner — do not extend the date.