Audits firebase.json before you run firebase deploy: ignore lists that let .env, source maps and admin keys reach the public bundle, catch-all public roots, and missing response headers. Runs entirely in your browser — nothing is uploaded.
Same engine as the VS Code extension, byte for byte.
This page is the working piece. The full pack has everything below.
Reads firebase.json and names the files your next firebase deploy would publish to the open web
A freelance web-security reviewer bills around $150 an hour.
Buy the full version — $29It reads firebase.json and applies 17 rules to it before you deploy. Seven rules cover what the ignore list lets through — .env files, source maps, service-account keys, dotfiles, node_modules. The rest cover the public root and the response headers Firebase Hosting will send. Each finding names the line, the exposure, and the entry to add.
Solo developers and two-to-five person teams shipping a React, Vue, Svelte or Next.js build to Firebase Hosting, especially when firebase.json was generated by an AI assistant or copied from a starter. It is for the person who runs firebase deploy themselves and has no reviewer between them and production.
Firebase replaces its three default ignore patterns the moment you supply your own array. A generic JSON linter sees valid JSON. A chatbot reasons about the lines present in the file you paste, not about the default that silently vanished when you added one entry. This tool checks for the absence.
Free covers one file completely: open a firebase.json, get all 17 checks with every finding shown, nothing truncated or watermarked, in VS Code or on the web page. The licence adds a different axis — every firebase.json in a monorepo scanned in one run, and an exported Markdown or JSON report you own.
A freelance web-security reviewer bills around $150 an hour, and a configuration review is rarely a single hour. The cheaper comparison is the incident: a leaked .env in a public bundle means rotating every key it held and, in the EU, a GDPR Article 33 notification within 72 hours of becoming aware.
One question, answered by the person who built it. Your email only if you want the answer sent.