What is firediff?

firediff diffs Firestore security rules by behavior. It runs the old and new rules side by side in the Firestore emulator and sends both the same generated requests: signed-out users, strangers, owners, and users with custom claims or role docs. It reports only the requests whose allow/deny flipped, each with a request you can replay. It's deterministic and doesn't use an LLM, and it never touches a real Firebase project.

Run it on every pull request

Add uses: Amsozzer1/firediff@v0.1 to a pull_request workflow. It posts one comment per PR listing who gained or lost access, and fails the check when access was gained. Locally: npx @amsozzer/firediff base.rules head.rules, or npx @amsozzer/firediff --since main.

GitHub · npm · GitHub Marketplace · MIT licensed