# Firebase Auth Security Rules

> Use this skill for Firebase security rules, auth claims, emulator tests, least privilege access. Trigger when the task involves apps work related to Firebase Auth Security Rules, production implementation, audits, debugging, strategy, or validation.

- Skill: `srednoff888-art/firebase-auth-security-rules` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add srednoff888-art/firebase-auth-security-rules`
- Raw SKILL.md: https://api.skillmd.com/api/skills/srednoff888-art/firebase-auth-security-rules/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: srednoff888-art (https://skillmd.com/u/srednoff888-art)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/srednoff888-art/firebase-auth-security-rules

---


# Firebase Auth Security Rules

Use this skill to handle Apps tasks focused on Firebase security rules, auth claims, emulator tests, least privilege access.

## Workflow

1. Clarify the user outcome, constraints, current stack, and definition of done.
2. Inspect the local repository or provided artifacts before proposing changes.
3. Check official documentation when APIs, platform rules, SDK versions, policies, or production behavior may have changed.
4. For non-trivial choices, compare proven open-source patterns or examples and adapt ideas without copying incompatible code.
5. Implement the smallest production-ready change that satisfies the request.
6. Validate with the most relevant checks: tests, lint, typecheck, build, browser/device review, audits, or manual scenario.
7. Report changed files, commands run, remaining risks, and exact next steps.

## Focus Checklist

- Define scope and assumptions explicitly.
- Prefer existing project conventions and tools.
- Handle loading, empty, error, permission, and edge states where relevant.
- Include security, privacy, performance, accessibility, and rollback considerations when they apply.
- Keep output actionable and evidence-backed.

## Guardrails

- Do not deploy permissive rules to production without explicit review.
- Do not perform destructive, paid, production, trading, publishing, or account-changing actions without explicit user confirmation.
- Do not expose secrets, private keys, tokens, cookies, personal data, or confidential business data.
- If validation is impossible, state exactly why and provide a manual verification path.