Google Cloud security

GCP security assessment, including Firebase.

Google Cloud's security surface spans two consoles: GCP and Firebase. Skydra audits both, including the Firebase edge cases — anonymous reads to a Realtime Database, writable Firestore collections, misconfigured auth — that a GCP-only tool consistently misses.

Create a workspace Compare clouds

IAM impersonation chains
GCS bucket probes
Firebase RTDB and Firestore
Cloud Run invokers and auth

Two complementary surfaces

URL probes and project audits.

Outside-in

What's reachable without credentials.

GCS bucket URLs — anonymous read, listing, writable probe
GCR / Artifact Registry URL patterns — anonymous image pull
Firebase Hosting URLs — exposed source maps, admin panels, backup files
Firebase RTDB auth probe — anonymous read on the database root
Firebase storage buckets
Firebase init.json exposure
Cloud Run service URLs with unauthenticated invokers
Google API key disclosure in client-side JavaScript
App Engine admin URLs

Inside-project

What an auditor service account sees.

IAM bindings — service account impersonation paths
GCS bucket IAM: all-users, all-authenticated-users
Cloud Run invoker binding and ingress
Cloud SQL public connectivity, SSL enforcement, backups
Cloud Functions trigger and ingress configuration
Firestore and Datastore rules
Pub/Sub topic IAM
Secret Manager rotation and access
Cloud KMS key purpose, rotation, HSM protection
GKE cluster: control plane access, Workload Identity, legacy auth

Named detectors

Each check is in packages/actions.

Identity and projects

gcp.audit
Project-level audit: IAM bindings, APIs enabled, service accounts
google.api_key
Validate an exposed Google API key against the real API
google.api_privileges
Discover what services an API key can call
gcp.probe
Project-wide probe for exposed resources

Storage and data

gcs.url
Pattern-match GCS URLs; anonymous read, listing, writable probe
gcs.cors
CORS misconfiguration on public GCS buckets
firebase.auth
Firebase Authentication posture — email enumeration, allowed providers
firebase.rtdb_auth_url
Firebase Realtime Database anonymous read probe
firebase.storage
Firebase storage bucket URL patterns and anonymous access
firestore
Firestore collection read without authentication
firestore.write
Firestore anonymous write probe
firebase.init_json
firebase-init.json exposure in web deployments

Compute and functions

gcp.invoke
Cloud Run invoker auth test
appengine.admin
App Engine admin API exposure
gcp.service_buckets
Service-owned buckets with disclosable configuration

Registries and artifacts

gcp.gcr_url
Google Container Registry URL patterns and anonymous pull
gcp.gar_url
Artifact Registry URL patterns
gcp.gar_probe
Artifact Registry anonymous probe
firebase.hosting_url
Firebase hosting bucket exposure

A representative runbook

Firebase exposure sweep across every project.

firebase-exposure-sweep.runbook (pseudo)

inputs:
  rootDomains: list<Domain>

steps:
  firebase_candidates:
    action: web.extract_firebase_configs
    forEach: inputs.rootDomains
    with: { domain: item }

  rtdb:
    action: firebase.rtdb_auth_url
    forEach: firebase_candidates.output.rtdbUrls
    with: { url: item }

  firestore:
    action: firestore
    forEach: firebase_candidates.output.firestoreProjectIds
    with: { projectId: item }

  storage:
    action: firebase.storage
    forEach: firebase_candidates.output.storageBuckets
    with: { bucket: item }

  summarise:
    action: slack.post
    condition: >
      rtdb.output.findings ne [] or
      firestore.output.findings ne [] or
      storage.output.findings ne []
    with:
      channel: "#security-ops"
      summary: templates.firebase_sweep.render(rtdb.output, firestore.output, storage.output)

Firebase projects are discoverable from a web app's HTML and JavaScript. Chaining web.extract_firebase_configs into provider-specific audits is one of the most consistently-rewarding patterns in cloud security testing — and in Skydra it is a composition, not a bespoke scanner.

Known edges

What we deliberately do not do.

GKE workload posture scanning is partial — Skydra audits control plane configuration, not container runtime behavior inside the cluster.
Cloud Asset Inventory ingestion is not an integration channel. Skydra enumerates resources via native APIs with least-privilege roles rather than mirroring Asset Inventory.
Deeper BigQuery data classification is out of scope. Skydra checks dataset-level IAM, not column-level data sensitivity.
Chronicle (SIEM) and Security Command Center ingestion are not shipped. Skydra produces evidence; downstream aggregation is operator-owned.
Firebase App Check and reCAPTCHA Enterprise posture is not currently audited — the surface is Firebase config and public RTDB/Firestore access.

Point Skydra at your GCP projects and Firebase apps.

Firebase exposure sweeps run from a workspace that has only your scope — no credentials needed for the outside-in half, and a least-privileged auditor service account for the inside half.

Create a workspace See AWS coverage