security-review

name	security-review
description	Review Firebase Security Rules and Angular application security patterns

Security Review Skill

Perform security audits focusing on Firebase Security Rules and Angular application security.

Quick Commands

# Validate Firestore rules syntax
firebase deploy --only firestore:rules --dry-run

# Run Firestore rules tests
npm run test:rules

Firebase Security Rules Review

Location

• Rules file: firestore.rules
• Rules tests: src/firestore.rules.spec.ts

Common Vulnerabilities

Issue	Risk	Check
Missing auth check	HIGH	Every rule should check request.auth != null
Overly permissive writes	HIGH	Validate data shape on writes
Missing resource ownership	HIGH	Verify request.auth.uid == resource.data.userId
Read-only fields modified	MEDIUM	Use !('fieldName' in request.resource.data.diff(resource.data))
Unbounded list queries	MEDIUM	Add limits to collection reads

Security Rules Checklist

[ ] All collections require authentication
[ ] Users can only access their own data (uid check)
[ ] Admin operations check custom claims
[ ] Write operations validate data structure
[ ] Sensitive fields cannot be modified after creation
[ ] Delete operations are appropriately restricted

Testing Rules Changes

# Start emulator and run rules tests
npm run test:rules

# Or manually:
npx firebase emulators:exec --project demo-test --only firestore 'npx vitest run --config vitest.rules.config.ts'

Angular Application Security

Authentication Checks

Pattern	Location
Route guards	src/app/authentication/
Pro-only directive	src/app/directives/pro-only.directive.ts
Has-role directive	src/app/directives/has-role.directive.ts

Secure Coding Checklist

[ ] No hardcoded API keys in source code
[ ] Environment files excluded from git
[ ] Firebase App Check enabled
[ ] CORS configured correctly on Cloud Functions
[ ] User input sanitized before storage
[ ] Error messages don't leak sensitive info

Review Template

When performing a security review, document findings using this format:

## Security Review: [Feature/Component]

### Scope
- Files reviewed: [list]
- Rules affected: [list]

### Findings

#### [CRITICAL/HIGH/MEDIUM/LOW] - Issue Title
- **Location**: `file:line`
- **Issue**: Description
- **Risk**: Potential impact
- **Recommendation**: How to fix