# Security Rules Published articles for Security Rules. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Authentication made easy: Building a secure e-commerce shopping cart with Firebase DevFeed: [Authentication made easy: Building a secure e-commerce shopping cart with Firebase]() Original publisher: [Read original article]() Author: Karl Weinmeister Published: 2026-09-01T00:00:00Z Content type: tutorial Language: en Sources: [Firebase Blog]() Topics: [Authentication](), [Firebase](), [Firestore](), [Authorization](), [Security]() Tags: [authentication](), [cloud-run](), [e-commerce](), [firebase](), [firestore](), [security-rules](), [shopping](), [tutorials](), [web]() ### AI overview This tutorial explains how to build a secure e-commerce shopping cart with Firebase Authentication and Cloud Firestore. It covers guest onboarding through anonymous authentication, migration of guest carts to permanent accounts, real-time synchronization, and checkout while addressing database permissions and security. ### Source excerpt News, tutorials, and updates from the Firebase team. ## Triple-layer security for Firebase web apps DevFeed: [Triple-layer security for Firebase web apps]() Original publisher: [Read original article]() Author: Roger Martinez Published: 2026-07-30T00:00:00Z Content type: tutorial Language: en Sources: [Firebase Blog]() Topics: [Firebase](), [Security](), [Web app](), [Firestore]() Tags: [app-check](), [apps](), [article](), [cloud-functions](), [firebase](), [firestore](), [security](), [security-rules](), [tutorials](), [web](), [web-apps]() ### AI overview This tutorial explains three layers of security for Firebase web apps: Firebase Security Rules, Google Cloud service accounts, and Firebase App Check. It focuses on narrowing Firestore rules by resource, allowed operations, and client identity, including a rule that limits reads to published articles. ### Source excerpt News, tutorials, and updates from the Firebase team. ## Adding AI-powered star-rating suggestions to reviews with Firebase AI Logic DevFeed: [Adding AI-powered star-rating suggestions to reviews with Firebase AI Logic]() Original publisher: [Read original article]() Author: Alexander Nohe; Jeff Huleatt Published: 2025-10-01T00:00:00Z Content type: tutorial Language: en Sources: [Firebase Blog]() Topics: [Firebase](), [Artificial Intelligence](), [Google AI](), [API keys](), [Generative AI]() Tags: [ai](), [ai-logic](), [api-keys](), [app-check](), [firebase](), [firestore](), [gemini](), [hybrid-inference](), [mcp](), [on-device-ai](), [react](), [recaptcha](), [security-rules](), [tutorials]() ### AI overview This tutorial explains how the Friendly Eats app uses Firebase AI Logic to suggest a star rating while a user writes a review. It discusses choosing a client-side SDK, protecting Gemini API keys through a proxy, using on-device models when available, securing requests with Firebase App Check, and balancing model cost, speed, and quality. ### Source excerpt News, tutorials, and updates from the Firebase team. ## Firebase MCP Server DevFeed: [Firebase MCP Server]() Original publisher: [Read original article]() Author: Michael Bleigh Published: 2025-05-20T10:47:00Z Content type: release Language: en Sources: [Firebase Blog]() Topics: [Firebase](), [MCP Server](), [Model Context Protocol](), [Firebase CLI](), [Artificial Intelligence]() Tags: [agents](), [ai](), [cloud-messaging](), [cloud-storage](), [experimental](), [explore](), [firebase](), [firebase-cli](), [firestore](), [google-i-o](), [launch](), [mcp](), [mcp-server](), [security-rules]() ### AI overview Firebase announces an experimental Firebase MCP Server, integrated with the Firebase CLI, that lets AI assistants and coding agents use standardized tools to configure, build, manage, and observe Firebase applications. The article describes capabilities including project setup, user management, Firestore access, GraphQL queries, security-rule validation, messaging, Remote Config deployment, crash monitoring, and Cloud Storage URL generation. ### Source excerpt News, tutorials, and updates from the Firebase team. ## Supabase Security Suite DevFeed: [Supabase Security Suite]() Original publisher: [Read original article]() Author: Paul Copplestone Published: 2024-07-11T07:00:00Z Content type: article Language: en Sources: [Supabase Blog]() Topics: [Supabase](), [Security](), [Shared Responsibility Model](), [dashboards](), [Tooling]() Tags: [postgres](), [security](), [security-rules](), [security-tools](), [self-hosting](), [shared-responsibility]() ### AI overview Supabase describes a three-month security, performance, and stability effort conducted with security researcher Eva and her colleagues. The article discusses Supabase's shared-responsibility approach, platform-integrated security tooling, use of Postgres Row Level Security, Lunchcat integration plans, Security Advisor rules and one-click fixes, and weekly security notifications for project owners. ### Source excerpt Learn how to use range columns in Postgres to simplify time-based queries and add constraints to prevent overlaps. ## Enhancing code to cloud security with the Common Configuration Scoring System DevFeed: [Enhancing code to cloud security with the Common Configuration Scoring System]() Original publisher: [Read original article]() Author: Wayne Crissman; Tal Dromi Published: 2023-12-14T14:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [iac-security](), [snyk-iac](), [Infrastructure as code](), [configuration](), [Application Security](), [sdlc](), [Security]() Tags: [application-security](), [aspm](), [awareness](), [blog](), [cloud-security](), [code-security](), [configuration](), [developer](), [engineering](), [iac](), [infrastructure-as-code](), [metrics](), [nist](), [sdlc](), [security](), [security-rules](), [snyk](), [snyk-security-intel](), [standards]() ### AI overview Snyk is standardizing its code-to-cloud security rules on the Common Configuration Scoring System (CCSS). The change applies to Snyk Infrastructure as Code (IaC), IaC+, and cloud configurations, using technical severity, threat intelligence, and application and business context to produce clearer risk assessments. ### Source excerpt To eliminate this burden and provide our customers with a clear security assessment for configurations across the SDLC, Snyk will be moving towards standardizing our code to cloud security rules set on the Common Configuration Scoring System (CCSS)! ## React Native file upload with Supabase Storage DevFeed: [React Native file upload with Supabase Storage]() Original publisher: [Read original article]() Author: Simon Grimm Published: 2023-08-01T07:00:00Z Content type: tutorial Language: en Sources: [Supabase Blog]() Topics: [Supabase](), [React Native](), [Expo](), [Authentication](), [API](), [App](), [passwords]() Tags: [api](), [app](), [authentication](), [github](), [react](), [react-native](), [security-rules](), [storage](), [tutorial]() ### AI overview This tutorial explains how to build a React Native file-upload app with Expo and Supabase Storage. It covers creating a Supabase project, configuring authentication, creating a protected storage bucket with access policies, and setting up the React Native application to upload images. ### Source excerpt Learn how to implement authentication and file upload in a React Native app. ## Using Cloud Monitoring to monitor App Check and Security Rules DevFeed: [Using Cloud Monitoring to monitor App Check and Security Rules]() Original publisher: [Read original article]() Author: Shruti Padamata Published: 2022-12-05T00:00:00Z Content type: tutorial Language: en Sources: [Firebase Blog]() Topics: [Firebase](), [Monitoring](), [Grafana Cloud Metrics](), [Security](), [Authorization](), [dashboards]() Tags: [app-check](), [cloud](), [cloud-monitoring](), [dashboards](), [firebase](), [firestore](), [incident](), [metrics](), [notify](), [security](), [security-rules]() ### AI overview A tutorial on using Cloud Monitoring with Firebase to monitor App Check and Security Rules. It explains where to find rules evaluation metrics, how to analyze them, and how to create an alerting policy for sustained spikes in denied evaluations. ### Source excerpt Learn how to monitor security metrics and set up alerting policies with Cloud Monitoring and Firebase. ## Announcing cross-service Security Rules DevFeed: [Announcing cross-service Security Rules]() Original publisher: [Read original article]() Author: Shruti Padamata Published: 2022-09-28T00:00:00Z Content type: release Language: en Sources: [Firebase Blog]() Topics: [Firebase](), [Security](), [Firestore](), [Cloud]() Tags: [cloud-storage](), [emulator-suite](), [feature](), [firebase](), [firebase-cli](), [firestore](), [security](), [security-rules]() ### AI overview Firebase announces cross-service Security Rules for Cloud Storage, allowing rules to query Firestore data in the same Firebase project. ### Source excerpt We're excited to deliver one of the most popular feature requests for Security Rules. Security Rules in Cloud Storage for Firebase now supports cross-service Rules. ## Meet the Firestore Emulator Requests Monitor DevFeed: [Meet the Firestore Emulator Requests Monitor]() Original publisher: [Read original article]() Author: Yuchen Shi Published: 2021-08-18T00:00:00Z Content type: release Language: en Sources: [Firebase Blog]() Topics: [Firestore](), [Firebase](), [monitor](), [Emulator](), [Security]() Tags: [emulator](), [emulator-suite](), [firebase](), [firebase-cli](), [firestore](), [launch](), [monitor](), [security-rules]() ### AI overview The article introduces the Firestore Emulator Requests Monitor, a Firebase Emulator UI feature that displays local Firestore requests in real time, including request details and Firebase Security Rules evaluations. It explains how to access the Requests view and use it to review requests, denials, errors, and rule evaluation details. ### Source excerpt News, tutorials, and updates from the Firebase team. ## How do you build the I/O photo booth? DevFeed: [How do you build the I/O photo booth?]() Original publisher: [Read original article]() Author: Firebase Team Published: 2021-05-27T00:00:00Z Content type: tutorial Language: en Sources: [Firebase Blog]() Topics: [Firebase](), [Flutter](), [Web app](), [Cloud Functions](), [hosting]() Tags: [case-study](), [cloud-functions](), [firebase](), [flutter](), [hosting](), [security-rules](), [tutorials](), [web-app]() ### AI overview A technical tutorial explaining how the I/O photo booth was built as a Flutter web app powered by Firebase. It covers anonymous authentication, security rules, hosting, storage, and Cloud Functions for photo sharing. ### Source excerpt News, tutorials, and updates from the Firebase team. ## How to code review security rules DevFeed: [How to code review security rules]() Original publisher: [Read original article]() Author: Rachel Myers Published: 2021-01-06T00:00:00Z Content type: tutorial Language: en Sources: [Firebase Blog]() Topics: [Security](), [Code review](), [Firebase](), [Firestore](), [Realtime Database](), [engineering-culture]() Tags: [admin-sdk](), [best-practices](), [code-review](), [firebase](), [firestore](), [how-to](), [pii](), [realtime-database](), [security](), [security-rules]() ### AI overview A tutorial on reviewing Firebase Security Rules, with examples focused on Firestore and guidance that also applies to Firebase Storage and, with language differences, the Realtime Database. It highlights global access rules, personally identifiable information, and document-level permissions. ### Source excerpt News, tutorials, and updates from the Firebase team. ## Forge: Password Protected Paths DevFeed: [Forge: Password Protected Paths]() Original publisher: [Read original article]() Author: James Brooks Published: 2020-07-31T14:47:00Z Content type: release Language: en Sources: [Laravel Blog]() Topics: [passwords](), [nginx](), [dashboards](), [Security](), [HTTP](), [servers]() Tags: [auth](), [configuration](), [feature](), [http](), [nginx](), [password](), [security](), [security-rules](), [server]() ### AI overview Forge now lets users configure and manage password-protected sites or paths from the dashboard. Its Security Rules feature uses HTTP Basic Auth, supports multiple credentials, and applies to valid Nginx location paths. ### Source excerpt We are excited to announce that you can now configure and manage password protected paths within the Forge dashboard. Previously, this had to be done manually by logging into the server and configuri... ## Product news and other highlights from Firebase Live DevFeed: [Product news and other highlights from Firebase Live]() Original publisher: [Read original article]() Author: Francis Ma Published: 2020-07-22T00:00:00Z Content type: news Language: en Sources: [Firebase Blog]() Topics: [Firebase](), [code productivity](), [Command-line interface](), [Web app]() Tags: [authentication](), [emulator-suite](), [extensions](), [firebase](), [google-analytics](), [ml-kit](), [news](), [product-news](), [security-rules](), [tutorials](), [updates]() ### AI overview Firebase recaps its Firebase Live web series, including product updates, videos, codelabs, an interactive demo, and answers to developer questions. The article highlights the new local emulator UI, which supports local development, log filtering, data testing, and safer experimentation without affecting shared environments or incurring billing costs. ### Source excerpt News, tutorials, and updates from the Firebase team. ## New improvements to Firestore Security Rules DevFeed: [New improvements to Firestore Security Rules]() Original publisher: [Read original article]() Author: Rachel Myers Published: 2020-06-17T00:00:00Z Content type: article Language: en Sources: [Firebase Blog]() Topics: [Firestore](), [Security](), [Firebase]() Tags: [firebase](), [firestore](), [improvements](), [launch](), [security](), [security-rules](), [update]() ### AI overview Firebase describes improvements to Cloud Firestore and Cloud Storage Security Rules, including changes to the Rules language, better tools for writing and debugging rules, and increased size limits. The article highlights new Set and Map methods and support for local variables within functions. ### Source excerpt News, tutorials, and updates from the Firebase team. ## Cloud Firestore Now Supports IN Queries! DevFeed: [Cloud Firestore Now Supports IN Queries!]() Original publisher: [Read original article]() Author: Todd Kerpelman Published: 2019-11-07T00:00:00Z Content type: news Language: en Sources: [Firebase Blog]() Topics: [Firestore](), [Query (disambiguation)](), [Firebase](), [Security]() Tags: [firebase](), [firestore](), [launch](), [news](), [security](), [security-rules](), [updates]() ### AI overview Cloud Firestore added IN queries, allowing applications to query for documents matching any of multiple specified values. The article also covers Firebase console support, security rule behavior, and limits including a maximum of 10 values and one such operation per query. ### Source excerpt News, tutorials, and updates from the Firebase team. ## What's new at Firebase Summit 2019 DevFeed: [What's new at Firebase Summit 2019]() Original publisher: [Read original article]() Author: Francis Ma Published: 2019-09-26T00:00:00Z Content type: news Language: en Sources: [Firebase Blog]() Topics: [Firebase](), [Mobile](), [Web](), [Google Cloud Platform (GCP)]() Tags: [android](), [app-distribution](), [app-quality](), [cloud-messaging](), [community](), [emulator-suite](), [extensions](), [fabric](), [fastlane](), [firebase](), [firebase-cli](), [firebase-summit](), [google-analytics](), [ios](), [machine-learning](), [mobile](), [news](), [open-source](), [predictions](), [react](), [react-native](), [realtime-database](), [remote-config](), [sdks](), [security-rules](), [test-lab](), [unity](), [updates](), [web]() ### AI overview Firebase Summit 2019 updates introduced Firebase Extensions, open-source bundles that automate common app development tasks, and expanded the Firebase Emulator Suite with hot reloading for Security Rules and broader client and server-side SDK support. ### Source excerpt News, tutorials, and updates from the Firebase team. ## 7 tips on Firebase security rules and the Admin SDK DevFeed: [7 tips on Firebase security rules and the Admin SDK]() Original publisher: [Read original article]() Author: Hiranya Jayathilaka; Rachel Myers Published: 2019-03-14T00:00:00Z Content type: tutorial Language: en Sources: [Firebase Blog]() Topics: [Firebase](), [Security](), [Authorization](), [SDKs](), [Authentication](), [Firestore](), [Realtime Database]() Tags: [admin-sdk](), [authorization](), [cloud-functions](), [firebase](), [firestore](), [realtime-database](), [security](), [security-rules]() ### AI overview This tutorial explains how Firebase security rules authorize and validate requests from client applications, and presents tips for using security rules with the Admin SDK. It highlights that Admin SDK requests bypass security rules and should therefore run only in trusted environments with appropriate administrative control. ### Source excerpt News, tutorials, and updates from the Firebase team. ## Cloud Firestore adds array queries and set-like element updates DevFeed: [Cloud Firestore adds array queries and set-like element updates]() Original publisher: [Read original article]() Author: Todd Kerpelman Published: 2018-08-09T00:00:00Z Content type: release Language: en Sources: [Firebase Blog]() Topics: [Firestore](), [Firebase](), [Data structures]() Tags: [arrays](), [firebase](), [firestore](), [launch](), [new-feature](), [sdks](), [security-rules](), [updates]() ### AI overview Cloud Firestore now supports querying array elements, adding or removing elements with set-like behavior, and security rules based on whether an element exists in an array. The changes are available with the latest client SDKs. ### Source excerpt News, tutorials, and updates from the Firebase team. ## Announcing the Firestore Security Rules Simulator! DevFeed: [Announcing the Firestore Security Rules Simulator!]() Original publisher: [Read original article]() Author: Sam Horlbeck Olsen Published: 2018-06-20T00:00:00Z Content type: release Language: en Sources: [Firebase Blog]() Topics: [Firestore](), [Security](), [Access Control](), [simulator](), [Documentation]() Tags: [access-control](), [authentication](), [documentation](), [firebase](), [firestore](), [launch](), [news](), [release](), [security](), [security-rules](), [simulator](), [testing](), [updates]() ### AI overview Firebase announces the Firestore Security Rules Simulator, which lets developers test reads, writes, and deletes, simulate authenticated users, and preview authentication tokens before deploying rules. The update also raises document access-call limits and improves reference documentation. ### Source excerpt News, tutorials, and updates from the Firebase team. ## Announcing version history support for Cloud Firestore Security Rules DevFeed: [Announcing version history support for Cloud Firestore Security Rules]() Original publisher: [Read original article]() Author: Rachel Myers Published: 2018-04-09T00:00:00Z Content type: news Language: en Sources: [Firebase Blog]() Topics: [Firestore](), [Security](), [Firebase](), [Firebase console](), [Firebase CLI]() Tags: [browser](), [console](), [firebase](), [firebase-cli](), [firestore](), [history](), [launch](), [news](), [rollback](), [security](), [security-rules](), [updates]() ### AI overview Firebase announced version history for Cloud Firestore Security Rules, allowing teams to browse published rule versions, compare changes, edit the current version, and roll back to an earlier version. ### Source excerpt News, tutorials, and updates from the Firebase team. ## Introducing Query-based Security Rules DevFeed: [Introducing Query-based Security Rules]() Original publisher: [Read original article]() Author: Tom Larkworthy Published: 2018-01-26T00:00:00Z Content type: release Language: en Sources: [Firebase Blog]() Topics: [Security](), [Firebase](), [Query (disambiguation)](), [data]() Tags: [firebase](), [launch](), [realtime-database](), [security](), [security-rules](), [tutorials](), [updates]() ### AI overview Firebase introduces query-based security rules for Realtime Database, allowing developers to restrict reads according to query properties such as result limits, user-specific access, and server time. The feature can also simplify data structures and be adopted incrementally alongside existing rules. ### Source excerpt News, tutorials, and updates from the Firebase team. ## Hamilton App Takes the Stage DevFeed: [Hamilton App Takes the Stage]() Original publisher: [Read original article]() Author: David DeRemer Published: 2017-08-16T00:00:00Z Content type: article Language: en Sources: [Firebase Blog]() Topics: [Firebase](), [Flutter](), [Cloud Functions](), [Mobile](), [Realtime Database](), [Back end](), [Serverless](), [Content Management System](), [Android](), [iOS]() Tags: [android](), [backend](), [case-study](), [cloud](), [cloud-functions](), [cloud-storage](), [cms](), [firebase](), [flutter](), [front-end](), [ios](), [mobile](), [mobile-development](), [notifications](), [realtime-database](), [security-rules](), [serverless](), [tutorials](), [updates]() ### AI overview Posse describes how it built and launched the official Hamilton app in three months using Firebase for backend infrastructure and Flutter for the iOS and Android front end. The article explains the app's serverless architecture, ticket lottery workflow, content management system, realtime updates, user profiles, notifications, and image processing. ### Source excerpt News, tutorials, and updates from the Firebase team. ## What happens to database listeners when security rules reject an update? DevFeed: [What happens to database listeners when security rules reject an update?]() Original publisher: [Read original article]() Author: Doug Stevenson Published: 2016-11-22T00:00:00Z Content type: tutorial Language: en Sources: [Firebase Blog]() Topics: [Firebase](), [Database](), [Security]() Tags: [android](), [database](), [firebase](), [realtime-database](), [security-rules](), [validation]() ### AI overview This Firebase tutorial explains how Realtime Database value listeners behave when security or validation rules reject a write. A listener may receive the attempted new value and then be triggered again with the original value before the write error is reported. ### Source excerpt News, tutorials, and updates from the Firebase team. [Next page]()