How Firebase Misconfigurations Expose Production Apps to Attackers

Firebase configurations embedded in mobile apps do not serve as a true security boundary, making misconfigured production services vulnerable to exploitation. Attackers can replicate legitimate app requests outside Android or iOS environments, bypassing client-side controls like hidden buttons or navigation restrictions if Security Rules are too permissive. Simply verifying that a user is authenticated is insufficient — authorization must tie the user's identity to specific resources and permitted actions. Sensitive operations such as refunds, KYC approvals, and role assignments should be handled exclusively by trusted backends that validate the actor, state, and input. A robust security model layers authentication, Security Rules, App Check, and backend enforcement while assuming the client can be inspected or automated.