Firebase

firebaseBackend38 lines

Google's app platform: authentication, Firestore, storage, functions and messaging.

Current — as published in v1.3.2. Written by hand for Firebase, not generated.

The rule

Security rules are the security

The client talks straight to the database, and the app config is public by design. Rules are the only thing protecting the data.
Deny by default; grant narrowly by path and request.auth.uid.
Rules live in firestore.rules, in git, deployed with the app. Never edit them in the console — environments drift and the difference surfaces in production.
The apiKey in the config is not a secret. Restricting it does not secure anything.

Access

One initializeApp for the whole app, in src/services/firebase/.
Components call a service; they never import the Firebase SDK directly.
Always handle the error branch — permission failures are normal and must be surfaced, not swallowed.

Queries

Every real query needs its composite index committed alongside the code.
Paginate with limit(). An unbounded collection read is both slow and expensive.
Detach listeners on unmount. A leaked listener bills for as long as it lives.

Privileged work

Anything the client must not do belongs in a Cloud Function using the Admin SDK, which bypasses rules.
The Admin service account key is server-side only. Never in the app.

Never

Never leave Firestore in test mode.
Never share one Firebase project across environments.
Never rely on client-side filtering for access control.

As each tool receives it

The same guidance, in the shape each editor reads. Cursor and Claude Code are written separately by hand; the rest are derived from the Cursor rule.

→ .cursor/rules/firebase.mdchand-written for this tool

.cursor/rules/firebase.mdc

---
description: Firebase conventions
globs: ["src/services/firebase/**", "firestore.rules", "functions/**"]
alwaysApply: false
---

# Firebase

## Security rules are the security

- The client talks straight to the database, and the app config is public by
  design. **Rules are the only thing protecting the data.**
- Deny by default; grant narrowly by path and `request.auth.uid`.
- Rules live in `firestore.rules`, in git, deployed with the app. Never edit
  them in the console — environments drift and the difference surfaces in
  production.
- The `apiKey` in the config is not a secret. Restricting it does not secure
  anything.

## Access

- One `initializeApp` for the whole app, in `src/services/firebase/`.
- Components call a service; they never import the Firebase SDK directly.
- Always handle the error branch — permission failures are normal and must be
  surfaced, not swallowed.

## Queries

- Every real query needs its composite index committed alongside the code.
- Paginate with `limit()`. An unbounded collection read is both slow and
  expensive.
- Detach listeners on unmount. A leaked listener bills for as long as it lives.

## Privileged work

- Anything the client must not do belongs in a Cloud Function using the Admin
  SDK, which bypasses rules.
- The Admin service account key is server-side only. Never in the app.

## Never

- Never leave Firestore in test mode.
- Never share one Firebase project across environments.
- Never rely on client-side filtering for access control.

What else this module writes

Selecting Firebase contributes more than a rule file — all of it merged with every other module you pick, with conflicts resolved rather than duplicated.

Environment

NEXT_PUBLIC_FIREBASE_API_KEYrequiredIdentifies the project. Public by design.

NEXT_PUBLIC_FIREBASE_AUTH_DOMAINrequiredAuth domain from the console.

NEXT_PUBLIC_FIREBASE_PROJECT_IDrequiredProject id.

NEXT_PUBLIC_FIREBASE_APP_IDrequiredApp id from Project settings.

NEXT_PUBLIC_FIREBASE_STORAGE_BUCKEToptionalStorage bucket, if you use Storage.

FIREBASE_SERVICE_ACCOUNToptionalAdmin SDK credentials JSON. Bypasses all rules — server-side only.

Dependencies

firebase^12.17.0firebase-tools^14.0.0dev

Folders

src/services/firebase/functions/src/

Checklists

checklists/firebase-security.md

conflicts withSupabase

Put this in your repo

Adds Firebase to a project this tool generated, without starting over. Files you have hand-edited are left alone.