Firebase
Firebase is Google's mobile and web application development platform, providing backend services including database, authentication, and hosting.
Core Facts
Supabase is an open-source alternative to Firebase that provides backend-as-a-service capabilities such as database, authentication, and real-time subscriptions based on PostgreSQL.
Firebase is a Backend-as-a-Service (BaaS) platform acquired by Google in 2014.
The Anti-Gravity desktop application natively connects to Google AI Studio, Android, and Firebase.
Timeline (last 90 days)
E-LabS's tech stack includes an AI experiment assistant based on Google Gemma 4, real-time charts, automatic Markdown report generation, a Three.js 3D simulation engine, and a KVKK-compliant user system based on Firebase.
Common ways to achieve data persistence include browser-side localStorage or IndexedDB, as well as cloud sync and multi-device access via a backend or BaaS (such as Firebase, Supabase).
The Firebase API key documentation explicitly states that the key can be included in code or committed configuration files, because data access is controlled by security rules and App Check.
The official Firebase "avoid insecure rules" documentation shows the allow read, write: if true; rule set and warns never to use it in production.
The allow read, write: if request.auth != null; rule is equivalent to any registered user being able to read and write the entire database, and Firebase officially lists it as a discouraged practice
When AI editors such as Cursor and Claude Code encounter Firebase's 'Missing or insufficient permissions' error, a common fix is to change firestore.rules to allow read, write: if true; or if request.auth != null;
When creating a Firestore database, Firebase offers a test mode that grants access to all users, causing a large number of public projects and tutorials to start from open rules.
Suponsa's backend tests started the Firebase emulator on a hosted runner and it did not survive five times: four times it hit a missing environment (such as Java 21), and the fifth time the runner was lost at 48 minutes; currently CI only runs the web suite, and the backend suite runs in the local commit gate.
Firebase security rules are the access control mechanism of Firebase cloud databases, and their default basis for judgment is the requester's identity rather than payment status; they can only verify whether a user is himself, not whether the user actually paid, and the correct approach is to leave the writing of subscription status entirely to a trusted backend, with the client having only read-only permissions.
AI Studio configured a Firebase cloud database for the app, and after 15 minutes it generated a login button, a sync banner, and a paywall, but did not integrate any payment system at all; after clicking the subscribe button, the code merely wrote a record into the database with Pro equal to true and a validity period of 30 days, and the security rules the AI wrote itself allowed any logged-in user to write this record for their own account, causing any logged-in user to turn themselves into Pro for free.
40 more timeline events
All Facts (20)
Supabase is an open-source alternative to Firebase that provides backend-as-a-service capabilities such as database, authentication, and real-time subscriptions based on PostgreSQL.
80%VerifiedFirebase is a Backend-as-a-Service (BaaS) platform acquired by Google in 2014.
75%VerifiedThe Anti-Gravity desktop application natively connects to Google AI Studio, Android, and Firebase.
70%VerifiedThe predecessor of Firebase AI Logic was Vertex AI in Firebase within Firebase.
65%VerifiedCloud Firestore is a NoSQL document database where single-field queries are automatically indexed, but composite queries involving multi-field filtering or sorting must have composite indexes created manually.
65%VerifiedRepresentative BaaS products include Google's Firebase, the open-source alternative Supabase, and AWS Amplify.
65%UnverifiedBaaS架构中前端通过SDK直接与数据库交互，安全边界从后端API下移到数据库规则层
95%UnverifiedFirebase Remote Config允许开发者在不发布应用更新的情况下动态修改应用行为，可用于存储Prompt模板版本ID实现灰度发布和快速回滚
90%UnverifiedFirebase AI Logic SDK支持结构化生成，通过在创建生成模型时传入输出Schema自动确保返回数据符合预期格式
90%UnverifiedFirebase在中国国内访问不稳定甚至被屏蔽，而CloudBase部署在国内节点延迟更低且合规
85%Unverified与Firebase不同，Supabase使用标准SQL，数据可完整导出，不存在供应商锁定风险
85%UnverifiedFirebase曾经默认关闭安全规则，导致大量应用被黑，最终不得不修改策略在一定天数后自动锁定数据库
85%UnverifiedE-LabS's tech stack includes an AI experiment assistant based on Google Gemma 4, real-time charts, automatic Markdown report generation, a Three.js 3D simulation engine, and a KVKK-compliant user system based on Firebase.
50%UnverifiedCommon ways to achieve data persistence include browser-side localStorage or IndexedDB, as well as cloud sync and multi-device access via a backend or BaaS (such as Firebase, Supabase).
50%UnverifiedWhen creating a Firestore database, Firebase offers a test mode that grants access to all users, causing a large number of public projects and tutorials to start from open rules.
50%UnverifiedThe Firebase API key documentation explicitly states that the key can be included in code or committed configuration files, because data access is controlled by security rules and App Check.
50%UnverifiedThe allow read, write: if request.auth != null; rule is equivalent to any registered user being able to read and write the entire database, and Firebase officially lists it as a discouraged practice
50%UnverifiedWhen AI editors such as Cursor and Claude Code encounter Firebase's 'Missing or insufficient permissions' error, a common fix is to change firestore.rules to allow read, write: if true; or if request.auth != null;
50%UnverifiedThe official Firebase "avoid insecure rules" documentation shows the allow read, write: if true; rule set and warns never to use it in production.
50%UnverifiedFirebase security rules are the access control mechanism of Firebase cloud databases, and their default basis for judgment is the requester's identity rather than payment status; they can only verify whether a user is himself, not whether the user actually paid, and the correct approach is to leave the writing of subscription status entirely to a trusted backend, with the client having only read-only permissions.
50%