Is my Firebase Studio app secure?

Firebase Studio builds Next.js apps on Firebase. It uses Cloud Firestore and Firebase Authentication for data and login, the Gemini Developer API via Genkit when the app uses AI, and Firebase App Hosting to publish. One thing to know before you build anything new: Google has announced that Firebase Studio is sunsetting on 22 March 2027, and as of 22 June 2026 it no longer accepts new workspaces or signups. Apps already built in Firebase Studio keep running, and Google points new projects to Google AI Studio or Google Antigravity. The problems that usually turn up are specific to that stack, not to Firebase Studio itself.

These are the things that usually turn up in apps built in Firebase Studio, in plain English. Each one points to where to go deeper, the launch checklist and the guides, rather than restating them.

• Anyone can read every customer's data. If the Firestore rules are left in test mode, or the rule is too broad, any logged-in user, or sometimes anyone, can read or change every document. (Firestore rules in test mode) The launch checklist, check 02.
• Data exposed through the default APIs. The platform's default endpoints can hand out data the front end never shows, if the rules do not stop it. A stranger who finds the endpoint reads the data directly. (exposed data) The launch checklist, check 02.
• A secret that ships to the browser. An API key or database credential that ended up in the client bundle. Anyone who opens the app can read it and use it against your database. (exposed credentials) The launch checklist, check 01.

These are a few of the common pitfalls, and there are many more. The full list is on the launch checklist.

Work through these on your own. They are free, and there is nothing to sign up for.

• The launch checklist. The questions to ask your AI before you launch, each with what a good answer looks like.
• Is my AI-built app safe to launch?. The three things AI-built apps keep shipping with.
• I built it with Lovable, Bolt or Cursor. Does that matter?. Why the tool does not matter, and what does.
• How much does my app cost to run?. The cost drivers and the exploits that ramp the bill.

The Quick Shakedown (from AUD 750) is the right fit for a Firebase Studio app. It covers the exact things these apps get wrong: open data, exposed keys, broken access. If you want the whole app reviewed rather than just the highest-risk parts, the Full Shakedown (from AUD 1,500) goes through everything and hands back the engineer-ready clean-up. If you are prepping for a launch or a raise, Launch-ready (from AUD 2,500) adds the written brief your first hire, or your AI, can work from. Every price is "from", quoted up front for the size of your app and fixed once agreed.