Firebase security rules review cost: $2,400, you own it

Firebase security rules review cost is $2,400 once for one app whose clients read Cloud Firestore or Cloud Storage. $1,200 starts the work. The report is due 48 hours after a test user can sign in. You own the PDF. There is no subscription.

The client talks to the data. The rules are the gate. A deployed file is not proof that gate holds.

Short answer: Firebase security rules review cost is $2,400 once, with $1,200 to start, for one app. I check the live screens, the login, and the Firestore and Storage rules those screens already trust, then write the report 48 hours after access works. You own it. Firebase’s usage bill and a multi-week accredited pentest are different products. The offer is the web application security review.

What does a Firebase security rules review cost?#

$2,400 once for one app, $1,200 to start, the rest when the PDF lands. You own that file. You are not buying Blaze usage, a scanner login, or a stamp I do not hold.

Firebase’s pricing plans split Spark, the no-cost plan, from Blaze, pay-as-you-go after the no-cost quotas. Cloud Storage for Firebase requires Blaze. That requirement took effect February 3, 2026, and no-cost usage still exists on Blaze (storage billing FAQ). None of that is a person signing in as your customer.

What you are buying	2026 price	What you actually get
This Firebase rules review	$2,400 once, $1,200 to start	One app, deployed Firestore and Storage rules, the UI that trusts them, report in 48 hours, one retest
Firebase Spark or Blaze	Spark: no-cost quotas. Blaze: usage after those quotas	The database and the bucket. Not a test of who can read them
Automated scan	About $100–$3,000	Mostly a known-bug list (WardenBit)
Small web app pentest	$2,500–$15,000, or $4,000–$12,000	A longer calendar, often aimed at a compliance packet (SecureLeap)

The same review at month 12 and month 24 is $7,200 over three years, one payment each time. That does not buy a CREST letter. The price is also on pricing.

A row-policy pass on Supabase is a different database. That writeup is Supabase RLS security review. This one is the rules file Firebase actually deployed.

What do those rules decide for a signed-in user?#

I sign in as the users you already ship and record which documents and files those sessions can open. The pass covers the pages, authentication, and the rules the console last deployed. The Admin SDK is a different key, and it does not belong in the browser.

Firebase’s rules basics are the bar:

• Locked mode restricts access. Test mode grants it. The Firestore and Storage locked-mode samples on that page are allow read, write: if false. A rule that lets any signed-in user through is a development shortcut, not a production gate.
• Insecure rules say an open project is on the internet. Anyone who guesses the project ID can steal, modify, or delete data if test mode never got closed. The console shows the last deployed rules. A git file that disagrees with the console is not what clients hit.
• Every Firestore request from a mobile or web client library is checked before data moves. If the rules deny any path in that request, the whole request fails (get started).
• The Admin SDK bypasses rules because it uses a service account. I record whether that key is only on a server you control. I do not take the key, and I do not paste a way to abuse it.
• Rules that call get(), exists(), or getAfter() are billed as extra document reads (Firestore pricing). I note them when they are the authorization check. I am not auditing your Google bill.

The document shape is the sample pentest report. No client names.

What is not included for $2,400?#

You get severity, path, role, and a fix an engineer can ticket, for one authorized app. I do not ship exploit steps, a rules rewrite, a second app, or a certificate I do not hold. The PDF is yours. There is no monthly fee.

A second app, a mobile binary, a network red team, and a rewrite of the rules file are separate quotes. If the service account is already in the client, I write that down. Moving it is your engineer’s job.

This is not AI Front Door, where a customer books or pays from ChatGPT, Claude, Grok, or another AI app that supports MCP connectors. MCP is the open standard those apps use to connect to a business’s tools. It is not Workflow Automation either. That offer is $3,500 once for one repeating ops job, such as an invoice chase, and it does not read Firestore rules.

How does the review run from access to the PDF?#

You authorize one URL, I use the test logins you send, and the clock starts when that login works. The deployed rules decide the document or the file. The PDF is what you keep. I do not deploy a rules change inside this price.

Step	What happens
Trigger	Customer documents or files are live, or a buyer asked who else can read them
Action	I walk the live UI as each test user and compare that session to the rules the console last deployed
System of record	Those deployed rules, plus the written findings: severity, path, role, fix
Human escalation	You ticket the change. I do not edit production rules inside this price

Send written authorization, at least one working test user, and a second user when two customers must not see each other. Say which collections or paths are supposed to be public. Name the engineer who owns the rules. One free retest of that same URL is included within 14 days.

When this isn’t the right move yet#

Do not pay the $1,200 if I cannot legally open the app, or if a buyer named a certificate this offer does not include. Get a URL and two test users first. A pass with no login is a homepage skim.

Wait if nobody can sign in as two customers today. Hire the firm that holds CREST if the questionnaire requires that name. If no client SDK can reach Firestore or Storage, say so before you pay. The rules may not be the gate. If the app is not on Firebase, the same web application security review still covers auth and the API. A missed phone is the receptionist, $8,000 once, not this review.

What should be true before I start?#

Bring the URL, two users, and one sentence on what is public. I start from the deployed rules. I cannot start without a login that behaves like production.

Before you pay, confirm these:

• The URL I may use, in writing.
• One user who should see their own records, and a second user who must not.
• Which collections, and which Storage paths, a signed-out visitor is supposed to read.
• That the service account stays on a server, not in the app binary or the browser.
• That someone can open the Firebase console rules tab if the git file and the deploy disagree.

If you want the layout before credentials, ask for the sample from the contact form.

$1,200 reserves the work on the review page. I confirm scope in writing before I start. The form is short. I reply with the replacement map within 24 hours. If you would rather talk through the workflow for 20 minutes and see whether this fits, book a 20-minute call.