Firestore Security Rules Audit — You Get the Attack LogAlam Fernandez
Firestore Security Rules Audit & Hardening — You Get the Attack Log, Not an Opinion
Most audits hand you a report and an opinion. This one hands you the evidence: the Proof Pack — every isolation probe run against your real data model, each attempt, the expected denial, and the actual result, in writing — then re-run after the fix so the denials are proved, not asserted.
And the fix is not a second purchase. A report-only rules review runs $2,400 in this market and never touches your rules. Here, Standard and Premium include the hardened, drop-in firestore.rules inside the audit price, with the re-test evidence included.
Why the number 51: we ran this suite on our own production multi-tenant SaaS first. The first sweep found three real holes in it. We closed them, re-proved 51/51, and published the whole run — failures included — under our own name. Ask any other auditor to show you theirs. (We publish only our own product's results. A client's results are never published, ever.)
Packages: Essential $495 — rules review + severity-rated findings report + emulator spot-checks on the highest-risk paths (no rewrite — stated plainly). Standard $950 — full probe suite, the Proof Pack, hardened rules, re-test evidence, a 30-day re-probe window (one full re-run within 30 days of delivery), walkthrough call. Premium $1,800 — plus Storage rules, claims/App Check hardening.
Two guarantees, in plain language. If the findings report isn't delivered within 5 business days of the agreed start, the audit fee is refunded in full. And on Standard and Premium: if the full suite and review produce no material finding — no cross-tenant access, no privilege-escalation path, no unauthenticated write surface, nothing rated Medium or above — the fee is refunded in full. A clean bill of health costs you nothing. (Essential runs no full suite, so findings-or-free doesn't attach to it.)
After the audit: the Monthly Re-Probe Care Plan — $450/month. The same suite re-runs monthly against your live rules, with a plain-language drift report and one fix-verification re-run. Rules decay one convenient change at a time; the plan catches it.
The method is published, not proprietary theatre: the 51-Probe Standard — full category breakdown published in our free Firestore Security Checklist.
Delivered by a senior software engineer (~30 years) who builds production multi-tenant systems on Firebase himself. What I need: your current firestore.rules and a data-model overview. No production credentials — the audit runs on the Firebase Emulator Suite.
Alam's other services
Starting at$495
Duration3 days
Tags
Firebase
Firebase Authentication
Firestore
Stripe
Security Rules
Service provided by
Alam Fernandez Orlando, USA
Firestore Security Rules Audit — You Get the Attack LogAlam Fernandez
Starting at$495
Duration3 days
Tags
Firebase
Firebase Authentication
Firestore
Stripe
Security Rules
Firestore Security Rules Audit & Hardening — You Get the Attack Log, Not an Opinion
Most audits hand you a report and an opinion. This one hands you the evidence: the Proof Pack — every isolation probe run against your real data model, each attempt, the expected denial, and the actual result, in writing — then re-run after the fix so the denials are proved, not asserted.
And the fix is not a second purchase. A report-only rules review runs $2,400 in this market and never touches your rules. Here, Standard and Premium include the hardened, drop-in firestore.rules inside the audit price, with the re-test evidence included.
Why the number 51: we ran this suite on our own production multi-tenant SaaS first. The first sweep found three real holes in it. We closed them, re-proved 51/51, and published the whole run — failures included — under our own name. Ask any other auditor to show you theirs. (We publish only our own product's results. A client's results are never published, ever.)
Packages: Essential $495 — rules review + severity-rated findings report + emulator spot-checks on the highest-risk paths (no rewrite — stated plainly). Standard $950 — full probe suite, the Proof Pack, hardened rules, re-test evidence, a 30-day re-probe window (one full re-run within 30 days of delivery), walkthrough call. Premium $1,800 — plus Storage rules, claims/App Check hardening.
Two guarantees, in plain language. If the findings report isn't delivered within 5 business days of the agreed start, the audit fee is refunded in full. And on Standard and Premium: if the full suite and review produce no material finding — no cross-tenant access, no privilege-escalation path, no unauthenticated write surface, nothing rated Medium or above — the fee is refunded in full. A clean bill of health costs you nothing. (Essential runs no full suite, so findings-or-free doesn't attach to it.)
After the audit: the Monthly Re-Probe Care Plan — $450/month. The same suite re-runs monthly against your live rules, with a plain-language drift report and one fix-verification re-run. Rules decay one convenient change at a time; the plan catches it.
The method is published, not proprietary theatre: the 51-Probe Standard — full category breakdown published in our free Firestore Security Checklist.
Delivered by a senior software engineer (~30 years) who builds production multi-tenant systems on Firebase himself. What I need: your current firestore.rules and a data-model overview. No production credentials — the audit runs on the Firebase Emulator Suite.
Alam's other services
$495