In case you missed it, I'm the owner of a one day 98k firebase bill.

Go to r/googlecloud and sort by "top posts of all time".

Some bad guy hit my storage bucket a zillion times and racked up the 98,000 bill in 18 hours. Google eventually reversed, but that didn't stop me from having uncontrollable diarrhea for a month and going to the hospital.

You guys should demand that they offer a real billing cap (they only offer alerts that can come in too late).

Otherwise, this platform is completely unsafe for you to work with (don't waste your time learning how to use firestore, for instance).

Sorry to be the bringer of bad news. I really liked the dev experience on firebase.

EDIT:

someone complained that this was a raw rant (It is) and I should channel my energy into helping other people prevent this. I already did. Here are the posts:

• what google needs to fix + detailed account of the attack

• how to deal with support

• other prevention tips

• public objects are dangerous

Hey guys just wanted to share here my first project!! Hope this is fine to do, it's been a long journey learning how to use firebase and just really stoked I've got something built and done!

For more info, it's a app where you can store your websites, social media posts and online content together in one space, rather than keeping all your bookmarks on like 10 different platforms

Would be cool if some of you could give me your thoughts on it and let me know of any things I can improve, it's free to use, and if interested, here's a demo and here's the App Store, Play Store and web app links too if you want to check it out!

👋 Hi, Firebase Reddit! I'm an engineering lead on the Firebase team and today marks my 10th anniversary at Google (and 10th anniversary working on Firebase). I thought it'd be a bit of fun to open things up for an AMA.

For a bit of context, I originally worked on Firebase Hosting, managed the Hosting/Functions/Extensions teams for a while, and now work across most of the Build products, also on Genkit, and a little on Firebase Studio.

Happy to chat on any topic but I can't give specifics on any upcoming features.

Wow this got a ton of great discussion, thank you all! I've got to go pick up my daughter from Girl Scout camp so I'm going to close this out, but thank you very much for all of the interesting questions and feedback.

Hi everyone!

First off, I would like to say how much of a fan I am of Firebase.
I first used Firebase a year ago to hack together a couple of MVP style projects and Firebase is PERFECT for those! Even now, multiple projects later, I'm still in awe as I discover and learn something new about Firebase each time.

The free tier limits on the spark plan is generous enough for testing out new ideas and provides enough sustenance for an idea to grow into something more concrete. The community here is also incredible supportive and I know there are Googlers/folks on the Firebase team that are pretty active on this sub as well, so a massive shoutout from a huge fan here.

Thank you for all the hard work in making Firebase what is it today!

Recently, I was lucky enough to have one of my projects take off a little. Utilizing resources above the free tier, so no big deal. I'm happy to pay and get on the blaze plan, which I did.

The first thing I did was (after upgrading), was figuring out how to limit/cap my maximum financial exposure. Should be a very simple switch or setting somewhere right?

That started to lead me down a rabbit hole. Of horror stories of bad code triggering massive bills, of extremely helpful and generous Googlers helping on a case-by-case basis and even the #1 post of all time on this sub is related to a billing horror story.

I think I've read all the documentation out there and so far it seems like the only way to have a hard limit is a duct tape solution thru pub/sub + cloud functions as described here and here.

I've also read through some great descriptions of the issue by leros, samtstern, cidan and others.

It does seem like Google/Firebase is fully aware of the desire for an easy way for Firebase users to do billing limits and I absolutely do not believe that Google is holding back from implementing it to make more money from us. The horror stories can't be good for business and the fact that they had been gracious enough to help out with genuine mistakes show that they're not out to get developers.

But I also strongly believe that having a hard billing limit setting is absolutely crucial, not just for mental health reasons, but also to help us protect us from ourselves. Look, i'm not a perfect developer, nowhere close in fact. I need guardrails, especially given how powerful the GCP infrastructure is... to protect me.

Yes, I know I have to do testing, etc. but mistakes happen in development. and those mistakes should not have the ability to bankrupt a dev, nor should we have to rely on the good graces of Google save us from financial destruction.

so here's my ask from the Google team:

Give us an easy setting within Usage/Billing in the firebase console to implement a hard billing cap*

*For avoidance of doubt, a hard cap means having a setting to limit our maximum cost to a certain set point and it's ok to stop services if it goes beyond that.

I suspect many other Firebase devs feel the same way. If you are a fellow dev and agree with my sentiments, please upvote this for visibility to Google management.

"Brakes are not just there to slow you down, they also give you confidence to go faster when you need to."

My firebase cost jumped from under $50 per month to $121,000 for last 2 days. I wrote some cloud function that was using translate and it ran millions of times due to error in code.How do I resolve this? I have written to google to give me one time pass on this.Did anyone else face this and how did they resolve this?

Update: Got waiver of all the charges of $122,000 from GCP. Final charges were roughly $1000 from Firebase. Requested for that waiver too:). Will update again if that happens. A huge burden off my head. Thank you so much to all of you for the support.

Is anyone else’s firebase auth not working? All of a sudden I am getting “Visibility check was unavailable. Please retry the request and contact support if the problem persists”

I just downloaded a very big Firestore collection (>=50,000 documents) by paginating with the offset function... I only downloaded half of the documents, and noticed I accrued a build of $60, apparently making 66 MILLION reads:

After doing some research I think I found out the cause, from the Firestore Docs:

So if I paginate using offset with a limit of 10, that would mean 10 + 20 + 30 +... reads, totaling to around 200 million requests...

I guess you could say it's my fault, but it is really user-unfriendly to include such an API without a warning. Thankfully I won't be using firebase anymore, and I wouldn't recommend anyone else use it after this experience.

Don't make my mistake.

Since a few months I am working on a side project - preliminary to learn some new stuff.

Currently I am experimenting with vibe coding new features of my app match-a-movie.com which on the first glance is absolutely nice. I planned to improve my algorithm which should improve the UX and Cursor translated it into nice code using angularfire - a firebase lib for angluar.

Further I added some comments and console.logs for checking and debugging the new features and eventually deployed the changes.

One month later a small shock - usually my firebase costs are about 50€/month. Now I got an invoice of 250€. My first thought was that my app went viral and traffic caused these hight costs.

Unfortunately my "simple" console.logs caused about 60€ in Cloud Logging storage costs - I was absolutely not aware of this.

Further, the vibe coded feature changes caused extremly many database reads which cost me about 150€ more than usual.

In the end, it was a learning for me to be aware of usage changes when integrating new features and to cleanup console.logs from debugging sessions before pushing.

So for context I created a program that was initially made to provide a fun way to teach a boring but important subject to my students. My students loved it so much they wanted to use it once they left so I hosted it on Firebase and it kinda spread as you can see. Right now I am only using google authentication, mainly because I don’t want to risk users data getting leaked. I am absolutely not a developer or claim to be a great programmer this is all self taught and I usually just make things for fun so I am not used to managing security. What are some things I need to focus on security wise?

@ Firebase Team, please add for Firestore DDoS protection, that would make us able to sleep easier at night, and would increase your customers + sales!

Hi, after this big discussion, I learned and thought a lot, and want to tell you my approaches what you can do to prevent a Firestore $99999 bill caused by a DDoS attack. Yes that can happen, especially if you have cruel competitors in a niche market. If you need protection for Cloud Storage, just add a CDN, it's quite easy! So, here we go with Firestore which is much more complicated:

1th measure:

Even though the friebase team removed daily budgets (very sad^{, I don't know why, please tell me why!} If a ddos attack appears we will use the monthly and not the daily amount of money (instead of e.g daily budget $100 you'll lose monthly budget $3000)), you can still add limits, so that this $99999 bill will never happen (thanks cidan), because you can't always be quickly enough to turn firestore off in case of an attack. But you gotta keep in mind: if these limits are triggered, your app will go offline, this will make your users very angry, and you may lose money, data (explained in the gcp TUTORIAL) and trust(! nobody trusts an app that suddenly goes offline, especially if you have an important business case like delivery). So the DDoS attackers will still get what they want. So we got to continue implementing solutions.

2nd optional measure:

Force your users to register, and display content only for authenticated users. This means: NO public data. Sure, it's a bad practice to force users to login (even though most iOS apps are doing that), you have to think about your business case, if you really wanna do that, or if it's ok since you will need their data either way. My way: I let first put in the user his data: name, birthday, gender, password, email, telephone number. Then I will send him a verification SMS with a code (this is only for stopping attackers to create 99999 accounts (and SMS notifications about delivery orders in my use case) since you can't get that much phone numbers^{(i think. i'm not sure}). Do not use 2FA with SMS! phone numbers are extremely insecure people lost money with hacked btc wallets, and even reddit had bad problems. After he completed that, I will e-mail him a confirmation mail with a link, for securing that it is really his e-mail/he didn't mistype his e-mail. How to stop authenticated users from DDoSing through writing: use cloud functions as a middle man, more explained below. How to stop through reading: also using cloud functions as a middle man (checking if it's a DDoSer, but I think Google Cloud Functions are afaik DDoS protected, I dunno if Firebase Cloud Functions are that also, @ firebase mods devs, please enlighten us) in combination with redis, continue reading!

3rd reserve measure:

Mirror your (public) data with redis! If someone DDoS attacks your firestore database you'll lose a lot of money. But if you use redis, you won't lose that much money (since it's cheaper), plus bonus: You can create fixed redis instances that do NOT scale up! (public data is not always that kind of important, so it's ok if it will be offline, but still a bad UX). Here's the tutorial for doing that with Cloud Memorystore, very easy! by u/andresmijares (if you ask nicely he may help you if you have problems setting it up). edit: Here is a quick tutorial I just wrote quickly up, which explains the basic thought how to manage CRUD requests with Redis/RTDB. I recommend to first go with RTDB since it's easy and quickly to setup. If you gotta scale your app just switch over to redis. ( you can also switch from firestore to BigTable(you need custom code logic on top) or Cloud Spanner, this will make your life also much easier)

Why is the 3rd measure only for reserve?

Using the Firebase iOS/Android SDK is awesome (thanks to invertase you can even use that within RN)! There are awesome features like caching syncing and so on. (I am using the Firebase SDK ONLY for reads. For writes I use cloud functions as a middleman for filtering insults, spam, and DDoS ^{(I look in realtime-database how much invocations the user did in the last 72 hours}).) You don't want to lose the great experience with the Firebase SDK! That's why it will be only a reserve if a real DDoS attack really happens (it didn't often happen in the past, but you never know, it's good to be ready in case). That's why you create a "rail-junction/rail-split" with Firebase Remote Config! You are just creating a boolean variable isDDoSattack , if it's false (no current DDoS attack) you will keep using on iOS/Android the Firebase SDK. If you have a DDoS attack, quickly turn off in the firestore security rules the read and write ability ^{(writing is in my case permanently turned off since I use cloud functions for writes}), and then immediately change within the Firebase Remote Config Console the variable to true. On the client side if the user wants to see new hamster videos, you basically just do:

If(remoteconfig.isDDoSattack == false){ firebasesdk.read.document.blablabla } else { fetch("https://redisendpoint.json")}

That's it! You see, it's a big deal but possible, but that still makes me sad, why the firebase team doesn't just add this anti DDoS feature... I'd also pay for that...

If you have more measures ideas or questions, just comment! Thank you very much!

edit:

4rd measure: (thanks to u/IxD )

>Every publish/update by registered users exports public (static) data from firebase db to json files on firebase storage. (by a firebase function)

That's an awesome idea for static data! But you won't be able to query the data anymore. But you could create one more static file for most queried results, e.g top10_restaurants_san_franciso.json and this json file just contains the 10 ID's of the restaurant with some "meta info" like the restaurant name, the ratings, and so on. but damn that's really crazy that we have to do things like this lol the firestore pricing model and/or lack of ddos protection is just bad... I love firebase, e.g the new features are so awesome, I don't wanna miss that! but please god please add ddos protection...

edit: for web apps, I highly recommend using gatsby to directly render public data and publishing it with a CDN, this is really a life savor. and yes rendering user generated data is also possible thanks to gatsby clouds incremental builds. (this ain't advertising, I just really appreciate gatsby cloud)

edit one more measure (thanks to Typesense.org ): You can protect your http endpoints FOR FREE!! like cloud functions, also from ddos via Cloudflares CNAME redirection, and it's completely free!!!! Here is a quick copy paste of my talk with Jason Bosco (typesense dev, awesome guy!):

"That said, one easy way to get DDOS protection currently is to setup Cloudflare DNS CNAMEs for each of the Typesense Cloud hostnames and proxy your requests via Cloudflare.

This way you can avoid the extra hop through Google Cloud functions, cold starts, etc and keep response times fast"

me: "So I won't even need to use cloud functions to access typesense from the cloud, brilliant!! - and this CNAME protection would be enough protection? (idk how CNAME works, it's not a simple domain forwarding or? (client -> xyz.com -> Cloudflare -> Typesense), because if it would be like the this attackers could just do client -> Typesense or not"

Jason: "Actually, I used the wrong word. It's not just a CNAME. Cloudflare actually proxies requests through their network.

So you'd use Cloudflare as your domain's nameserver and then setup a sub-domain like typesense1.yourdomain.com in Cloudflare DNS and point that to xxx-1.a1.typesense.net, etc (one for each typesense node)

So any requests made to typesense1.yourdomain.com actually get proxied through Cloudflare's network, and Cloudflare makes a call out to your Typesense Cloud nodes from their edge servers"

Me: "So attackers won't be able to find out the xxx-1.a1.typesense.net URL to ddos it? So I basically need to setup the URL like a uuid4 qpdjcjjdkeoe28384848ejrjdj-1.a1.typesense.net ? "

Jason: "Cloudflare doesn't reveal the hostname(s) that it proxies to. So all your users will see is that requests are being made to typesense1.yourdomain.com

That hostname points to a set of Cloudflare edge IPs. Behind the scenes, cloudflare will then proxy the call to the Typesense Cloud hostname. So your end users won't see the Typesense Cloud hostname anywhere for them to reach it"

So basically guysgals: you have to give your Cloud Functions stupid long uuidv4 names (and maybe do CORS stuff (idk im a noob at this topic) so that ONLY Cloudflare make http requests and everyone else's gets blocked) kwixsowojdjcjskwosodxkkdkwkwi.cloud-function.com so that no one on earth will be able to guess them correctly, so that no one will be able to ddos them. once again it would be cool if you can achieve to do some CORS stuff so that no one except Cloudflare can fetch your cloud functions. If someone has an idea if that's currently possible with Firebase cloud functions feel free to comment.

edit: yea it works: https://cloud.google.com/functions/docs/securing

July edit: 5rd measure (i'm currently takin): I gave up using the Firestore SDK. I even stopped using cloud functions because they are a waste of money . even though you can still use them, it's your choice, they are also compatible with Load Balancing & Cloud Armor. I use 'em only for onTrigger events. I am using Cloud Run now in combination with Cloud Load Balancing & Cloud Armor. That's it. If someone wants to read my data, he has to request my Cloud Run API. that's it. If you don't wanna use Cloud Armor (maybe for pricing reasons), you can use Cloudflare too.

Hey everyone,

Like many of you, I spend a lot of time in the Firebase console, and honestly, it was slowing me down. The constant clicking, page reloads, and clunky UI for managing Firestore and Auth just felt inefficient.

So, I built Firepilot: a desktop app designed for speed and control.

• Manage Firestore and Firebase Auth faster and with less frustration than the default console

• Query, view, and edit data with minimal clicks and instant feedback

• Export, import, and back up Firestore and Auth data with ease

• Get started quickly by just connect with a service account and dive in

• Navigate and edit data rapidly with powerful keyboard shortcuts

You can grab the 7-day free trial from here: https://firepilot.app

It’s currently in beta for macOS, and I’d love feedback from fellow Firebase devs, what you think, and what features you’d like to see next.

Edit: 29 Aug 2025 — v0.1.5: quick update, released v0.1.5: added multi-database support, shipped an x86 (Intel) build for older Macs, and rolled out a more sophisticated sidebar. These came directly from user requests, thanks for your feedback.

Super excited about the launch of Firebase Studio! 🔥

https://firebase.studio

Such an amazing moment and very thankful for the community that has helped Project IDX become what it is today 💙

Stay tuned for new templates and features! 👀

Just wanted to post this in response to some previous posts on here claiming Firebase is only fitting for small companies/projects

I created a new Firestore GUI client!

https://firefoo.com

Hey r/Firebase! About a year ago we started using Cloud Firestore at work. And while I love it for its amazing realtime and effortless scaling capabilities, I grew more and more frustrated with the limitation in tooling around it. No way to query from shell, export collections, rename docs, edit nested field names, …

One day I had enough and pitched an idea to a friend: to create the experience I wanted to see. Luckily he was all in and we continued to spend our Corona lockdown hacking together an Electron app in TypeScript that makes my work delightful again!

A few months later and we're glad to announce that Firefoo is now live for everyone to use!

Some features include

• Table View

• Export to JSON and CSV

• JavaScript Query Shell

• Batch Edit Documents

• Geo Point Map

We'd love to hear your thoughts and will be around in the comments all day!

- Mathis & Moritz

Big spike in posts here lately that are nebulous Firebase Studio issues and easily unrelated to Firebase APIs. Just my .02

I'm using Firebase for a small private project. On July 11, during the migration of Firebase functions from gen1 to gen2, the function trigger changed from "onDocumentCreated" to "onDocumentWritten," resulting in code that could cause infinite loops.

The disaster began on July 31, and when I realized the situation had become serious, the charges had just exceeded $8k based on reports at the time. I'm currently talking to Google Cloud Support, but I'm so scared.

How should I deal with this? Is there anyone who has been in the same situation as me?