How to Monitor Your FlutterFlow App's Security

Firebase App Check verifies that API requests come from your legitimate app binary, not from unauthorized scripts or reverse-engineered clients. In Firebase Console, go to App Check > Register your app. Use Play Integrity for Android, DeviceCheck for iOS, and reCAPTCHA Enterprise for web. After registering, enable Enforcement mode in App Check settings — this starts blocking unregistered clients from accessing Firebase services. Monitor the App Check Metrics dashboard to see the ratio of verified vs unverified requests. A sudden spike in unverified requests means someone is trying to use your Firebase project directly without your app.

Firebase Authentication writes all auth events to Google Cloud Logging. Navigate to Google Cloud Console > Logging > Logs Explorer. Filter by resource.type='identitytoolkit.googleapis.com' and look for SIGN_IN_FAILURE, USER_NOT_FOUND, and WRONG_PASSWORD events. Create a log-based metric that counts authentication failures per IP address per minute. In Cloud Monitoring, create an alerting policy that fires when this metric exceeds a threshold — for example, 10 failed logins from the same IP within 5 minutes indicates a credential stuffing or brute force attack. Route alerts to your email or a PagerDuty integration.

1// Cloud Function: triggered by Auth log sink via Pub/Sub
2// Creates alert when > 10 failed logins from same IP in 5 minutes
3
4const functions = require('firebase-functions');
5const admin = require('firebase-admin');
6const axios = require('axios');
7
8exports.monitorAuthFailures = functions.pubsub
9  .topic('auth-events')
10  .onPublish(async (message) => {
11    const event = JSON.parse(Buffer.from(message.data, 'base64').toString());
12    if (event.event_type !== 'SIGN_IN_FAILURE') return;
13
14    const ip = event.ip_address;
15    const db = admin.firestore();
16    const now = Date.now();
17    const windowStart = now - 5 * 60 * 1000; // 5 minutes
18
19    // Track failure count for this IP in the last 5 minutes
20    const ref = db.collection('security_events').doc(`ip_${ip.replace(/\./g, '_')}`);
21    await db.runTransaction(async (tx) => {
22      const snap = await tx.get(ref);
23      const data = snap.data() || { failures: [], alerted: false };
24
25      // Remove entries older than 5 minutes
26      const recent = (data.failures || []).filter((t) => t > windowStart);
27      recent.push(now);
28
29      if (recent.length >= 10 && !data.alerted) {
30        await sendSecurityAlert(`Possible brute force attack from IP: ${ip}. ${recent.length} failed logins in 5 minutes.`);
31        tx.set(ref, { failures: recent, alerted: true, alerted_at: now });
32      } else {
33        tx.set(ref, { failures: recent, alerted: data.alerted });
34      }
35    });
36  });
37
38async function sendSecurityAlert(message) {
39  const slackWebhook = process.env.SLACK_SECURITY_WEBHOOK;
40  if (slackWebhook) {
41    await axios.post(slackWebhook, { text: `🚨 Security Alert: ${message}` });
42  }
43}

Firestore Security Rules log denials in Cloud Logging, but successful reads and writes of sensitive data are not automatically audited. Build a custom audit log by creating a Firestore collection called 'audit_log' and writing an entry for every sensitive operation: reading financial records, updating subscription status, accessing PII, or changing user roles. Create a Cloud Function triggered on writes to sensitive collections that appends to the audit log. Each audit entry should contain: user_id, operation (read/write/delete), collection, document_id, timestamp, ip_address (from request context), and a summary of changed fields.

1// Cloud Function: audit log writer for sensitive collections
2exports.auditSensitiveWrites = functions.firestore
3  .document('subscriptions/{subId}')
4  .onWrite(async (change, context) => {
5    const before = change.before.data() || {};
6    const after = change.after.data() || {};
7    const userId = context.auth?.uid;
8
9    // Build diff of changed fields
10    const changedFields = Object.keys(after).filter(
11      (k) => JSON.stringify(before[k]) !== JSON.stringify(after[k])
12    );
13
14    await admin.firestore().collection('audit_log').add({
15      user_id: userId || 'unauthenticated',
16      operation: !change.before.exists ? 'create'
17               : !change.after.exists ? 'delete' : 'update',
18      collection: 'subscriptions',
19      document_id: context.params.subId,
20      changed_fields: changedFields,
21      timestamp: admin.firestore.FieldValue.serverTimestamp(),
22      event_id: context.eventId,
23    });
24  });

When Firestore Security Rules deny a request, Firebase writes a log entry to Cloud Logging with the resource path and the rule that blocked it. In Google Cloud Console > Logging > Logs Explorer, filter for firestore.googleapis.com and PERMISSION_DENIED. Create a log-based metric counting denials by resource path. High denial rates on a specific document path mean either your rules are too strict (legitimate users blocked) or an attacker is probing your data structure. In Cloud Monitoring, set an alert for more than 50 rule denials per minute on any single path.

Create an AdminSecurity page in FlutterFlow visible only to users with the 'admin' role in Firestore. Add widgets to display: recent audit_log entries as a ListView (last 50 entries, ordered by timestamp descending), a count of security_events documents with alerts flagged in the last 24 hours, the App Check verification ratio from a Firestore document that your Cloud Function writes daily, and a list of the top 5 most-denied Firestore paths from the last hour. This gives RapidDev and your team a single pane of glass for security health without navigating multiple Firebase console tabs.