· ReadyStack
Worked example
Real numbers from this tool, line by line.
Seven high-severity findings came out of one 23-line firebase.json — the config a solo React developer gets from an AI assistant on the first ask and deploys the same afternoon.
The file parsed. The deploy succeeded. The site loaded. Nothing in that sequence tells you what went up with it.
Firebase Hosting uploads exactly what firebase.json tells it to upload, and two lines decide that: hosting.public, which names the directory, and hosting.ignore, which names what to leave behind. Firebase ships three defaults for the second one — "firebase.json", "**/.*", "/node_modules/". Here is the part that costs people their keys: the moment you supply your own ignore array, those three are replaced, not extended.
So a config that reads "ignore": ["node_modules"] looks stricter than the default and is in fact weaker than it. The dotfile pattern is gone. Every dotfile under the public root is now a file served over HTTPS at a path anyone can guess: /.env, /.env.production, /.npmrc, and the contents of /.git if the build directory is the repository root — which it is, in that sample, because public was set to ".".
That is a generated-config failure mode specifically: an assistant optimises for a config that deploys, and the default it silently replaced is not in the text it is looking at.
Run the 23-line sample through the audit and 13 findings come back: 7 high, 5 medium, 1 low.
NaN
The medium ones are quieter: no Strict-Transport-Security, no X-Content-Type-Options, no framing rule — so the signed-in app can be loaded in an invisible iframe on someone else's domain — nested node_modules still uploading file by file, and Cache-Control: max-age=31536000 on **/*.html, which is why a deploy sometimes appears not to have landed: the CDN keeps serving last week's index.html, pointing at asset hashes that no longer exist.
A leaked .env is not a lint warning. It is a key rotation across every service that file named, and in the EU it starts a GDPR Article 33 clock: 72 hours from becoming aware to notify the supervisory authority. The awkward part of a Hosting leak is that "becoming aware" can arrive months late, because a static file served at a guessable URL leaves no signal in your own logs.
The audit is 17 rules over that one file, grouped three ways: where the bundle comes from, what the ignore list lets through, and what the CDN answers with. Each finding carries a severity, the line number, what an outsider gets because of it, and the exact array entry or header to add. Multi-target configs are handled — hosting can be an object or an array, and each block is reported under its own target name.
The same sample, corrected, returns 0 findings. That is the whole point of the pairing: the fix is eight strings in an array and one headers block, and the tool's job is to tell you which eight.
Free covers one file completely — all 17 checks, every finding shown, in VS Code or on the web page, with nothing truncated, watermarked or counted down. The $29 licence changes the axis, not the depth: every firebase.json in a monorepo audited in one run, and a Markdown or JSON report you own and can commit, attach to a release, or hand to a client. A freelance web-security reviewer bills around $150 an hour.
Web version, no install: https://getreadystack.com/tools/firebase-deploy-leak-audit
15 seconds — what it actually does
Questions people ask
What does Firebase Deploy Leak Audit actually do?
It reads firebase.json and applies 17 rules to it before you deploy. Seven rules cover what the ignore list lets through — .env files, source maps, service-account keys, dotfiles, node_modules. The rest cover the public root and the response headers Firebase Hosting will send. Each finding names the line, the exposure, and the entry to add.
Who is it for?
Solo developers and two-to-five person teams shipping a React, Vue, Svelte or Next.js build to Firebase Hosting, especially when firebase.json was generated by an AI assistant or copied from a starter. It is for the person who runs firebase deploy themselves and has no reviewer between them and production.
Why is a chatbot or a generic linter not enough?
Firebase replaces its three default ignore patterns the moment you supply your own array. A generic JSON linter sees valid JSON. A chatbot reasons about the lines present in the file you paste, not about the default that silently vanished when you added one entry. This tool checks for the absence.
What is free and what does the $29 licence add?
Free covers one file completely: open a firebase.json, get all 17 checks with every finding shown, nothing truncated or watermarked, in VS Code or on the web page. The licence adds a different axis — every firebase.json in a monorepo scanned in one run, and an exported Markdown or JSON report you own.
What would this cost me otherwise?
A freelance web-security reviewer bills around $150 an hour, and a configuration review is rarely a single hour. The cheaper comparison is the incident: a leaked .env in a public bundle means rotating every key it held and, in the EU, a GDPR Article 33 notification within 72 hours of becoming aware.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. Firebase Deploy Leak Audit checks the file you open against 17 rules from a rule set dated 2026-09-20, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.