Firebase Studio is safe to build with, but a generated app's security depends almost entirely on Firebase Security Rules, and the default or generated rules are often too permissive. Combined with the fact that Firebase config ships to the client by design, an app with open rules is readable and writable by anyone, even though the config being public is expected.
The risks that actually matter
Permissive Security Rules
The Firebase config is public by design, so your database is only as safe as your Security Rules. A test-mode or allow-all rule leaves everything open to anyone.
Hardcoded server-side secrets
While the client config is meant to be public, service account keys and other server secrets must never be in client code or a repo.
Missing validation in rules
Rules that allow writes without validating shape or ownership let users corrupt or read data they should not.
How to secure a Firebase Studio app
- Write Firebase Security Rules that scope reads and writes to the authenticated owner; never ship test-mode rules.
- Keep service account keys and server secrets out of client code and the repo.
- Validate data shape and ownership inside your rules.
- Scan the app for any server secret that reached the client or the repo.