Field notes from production Firebase work.
September 11, 2026 · FlameRangers
Every rules-based authorization model in Firebase ends up as a token claim, a get() against a role document, or both. The tradeoffs are latency, cost, revocation lag, and a 1000-byte ceiling.
Read moreSeptember 10, 2026
App Check stops scripted clients from hammering your Firestore and Functions, and it will happily lock out your own paying users if you enforce it on day one. Here is the metrics-first rollout we run.
Read moreAugust 11, 2026
"Should we migrate off Firebase?" is usually the wrong question. The signals that one workload has outgrown the platform — and the Auth and data seams that keep the hybrid clean.
Read moreJuly 15, 2026
Gen 2 changes concurrency, timeouts, config, and event delivery — not just the SDK import. What actually changes, the traps, and a cutover order that avoids double-execution.
Read moreJune 9, 2026
Two apps with the same users can differ 50x in Firestore spend. The difference is a short list of read and write amplification patterns — here they are, with fixes.
Read more