Built a browser extension that flags exposed Firebase rules

Close

Warns you when a site's database is readable by anyone.

It watches for Firebase config in the pages you visit, tries a single read against a path that should be denied, and shows a badge when it succeeds. Your own projects only, and it never writes anything.

Copilot handled the extension boilerplate. What surprised me is how often the badge lights up on small production sites, which is depressing rather than satisfying. I added a rate limit so it cannot be pointed at a list of domains.