October 26, 2026 · FlameRangers
One project per environment, rules and indexes in the repo, the emulator suite running your tests on every pull request, and a deploy order that does not break on index builds. The environment setup we put in place on hardening engagements, and the failure mode each piece prevents.
Read moreOctober 5, 2026 · FlameRangers
Phone auth is a payment API with a login screen attached. Here is how SMS pumping drains a Firebase bill, what reCAPTCHA Enterprise and region allowlists actually stop, and where blocking functions belong in the sign-up path.
Read moreSeptember 21, 2026 · FlameRangers
ID tokens expire every hour and never reach your server on a hard navigation. Session cookies do. Here is the exchange endpoint, the verification path, the revocation story, and what each choice costs per request.
Read moreSeptember 21, 2026 · FlameRangers
Storage gets the rules nobody tests. Client-declared content types, unbounded uploads, and Firebase download tokens that ignore your ruleset entirely — plus the egress line they put on your invoice.
Read moreSeptember 17, 2026 · FlameRangers
Firebase AI Logic lets a mobile or web client call Gemini without an API key in the bundle. It does not stop one user from spending your monthly model budget in an afternoon. Here is the enforcement stack we install.
Read moreSeptember 11, 2026 · FlameRangers
Every rules-based authorization model in Firebase ends up as a token claim, a get() against a role document, or both. The tradeoffs are latency, cost, revocation lag, and a 1000-byte ceiling.
Read moreSeptember 10, 2026
App Check stops scripted clients from hammering your Firestore and Functions, and it will happily lock out your own paying users if you enforce it on day one. Here is the metrics-first rollout we run.
Read moreApril 14, 2026
Security rules are the highest-consequence, least-tested code in most Firebase apps. A practical emulator test harness — and the denial tests that matter more than the grants.
Read more