Why do Firebase teams still need an outside-in scan?
Your Firestore rules can be tight while your public domain looks rough. Buyers do not start in the Firebase console. They start with TLS, headers, DNS, and email auth on the hostname you put in front of the app.
Firebase moves fast. Public hardening often lags. This checklist catches the gaps anyone can see without credentials.
What is on the Firebase app security checklist?
- Production domain TLS is valid and current.
- Security headers show up on live responses.
- DNS records are clean and consistent.
- Email authentication is set if the app sends mail from the domain.
- Public exposure signals are trimmed where possible.
- Reputation checks for blocklist or unsafe listings.
RedScore scores these in one pass and ranks what to fix first.
What does this checklist skip?
Firestore rules, Storage rules, Firebase Auth configuration, and secrets in your client bundle. All important. All separate from the free outside-in scan.
How do I run it?
Go to /lookup and enter your production domain. Run it before you share a production URL with users, payments, or a customer security review.