Firebase bill spike
How it usually startsA budget alert email, or a Cloud Billing report showing one product
(Firestore reads, Cloud Functions, Storage) far above normal.Find which product spiked, then stop the cause: usually a function that triggers itself, a query or listener reading far too much, or open security rules. Budgets on their own only alert; they don't stop spending.
Why it happens
Google Cloud is clear that an alerts-only budget does not cap usage or spending. Firebase lists the common causes of surprise bills: a database query with no limit over millions of documents, and Cloud Functions that fan out or loop forever (for example a function that writes to the same document that triggers it).
Open security rules and unprotected backends add a third cause: anyone can read or write your data at your expense.
Fix it by hand
- Find the product. In the Firebase console's usage and billing pages, or in Cloud Billing reports, see which service and which day spiked. Firestore and Storage usage is calculated daily; Cloud Functions usage monthly.
- Stop runaway functions. If a function is looping, disable or delete it now, then fix it: a trigger function should exit early when the change was made by itself (compare the before and after data, or write a marker field).
- Cap what can be capped. Firebase spend cap budgets pause a service for the rest of the month when it reaches 100% of its budget. Firebase lists them for Firebase AI Logic, App Hosting, Cloud Functions for Firebase and Extensions. Set them in the Firebase console or the Google Cloud console.
- For everything else, set alerts and an emergency brake. Budget alerts email you at thresholds. Google also documents using budget notifications (through Pub/Sub) to programmatically disable billing on a project. Without billing, the project's paid services stop, so use it as a last resort.
- Lock your rules. Make sure no Firestore, Realtime Database or Storage rule allows public read or write (for example
allow read, write: if true;). Require sign-in and check ownership. - Turn on App Check so only your app can call your backends, and add
limit()to queries and detach listeners you no longer need.
Stop it happening again
- Test functions and rules with the Firebase Local Emulator Suite before deploying, as Firebase recommends.
- Set budget alerts on every project, and spend caps where they're supported.
- Never ship test-mode rules to production.
Bill Spiked $7
Bill Spiked flags self-triggering functions, unbounded queries, open endpoints and missing caps in your code, ranked by blast radius, and gives a spending-cap checklist for each provider it finds, Firebase and Google Cloud included.
- Finds the uncapped calls, loops and open endpoints that run up a bill, ranked by how much damage each can do.
- Adds the limits as diffs you approve, and gives a spending-cap checklist for each paid provider in your code.
- Verdict first. Every finding shows the file and line, what it breaks, and the fix as a diff that is applied only with your OK.
Bill Spiked: how it works, with examples · Install guide
Works with Claude Code, Claude.ai, Cursor, Codex and other agents that read SKILL.md files. No installs, no accounts, works offline. No-questions refund.