Skip to content
← All projects

Firestore Rules Linter

Static analysis for security rules — flags permissive matches, missing catch-alls, and writes that trust request data.

firebasesecurityclinode
View code ↗

Security rules fail open. A missing condition is not a syntax error — it is a data breach that deploys cleanly.

What it catches

  • allow read, write: if true outside an explicitly public path
  • Rule files with no terminal deny, leaving unmatched paths undefined
  • Conditions reading request.resource.data for authorization, which the caller controls
  • update rules without hasOnly, permitting arbitrary field writes
  • get() calls inside loops that blow the ten-lookup limit at runtime

Usage

npx firestore-rules-lint firestore.rules --strict

Exits non-zero on findings, so it drops into CI ahead of firebase deploy.