Tamarack Development Co. — TamDevCo for short — is a Nevada-based development company committed to building trust-centered digital tools.
FireScan only works if developers trust it. That means being clear about what it accesses, what it sends, what it stores, and what it never touches.
General FAQs
What is FireScan?
FireScan is a command-line security posture scanner for Firebase projects. It reviews security-related configuration across areas such as Firestore, Cloud Storage, Authentication, App Check, Cloud Functions, Realtime Database, and Google Cloud IAM, then gives you an overall score and actionable findings. FireScan is designed to help identify common misconfigurations and security risks before they become problems.
Do I need to give FireScan my Google credentials?
No. FireScan does not ask you to upload or share your Google credentials. It uses Google Application Default Credentials on your own computer to read the configuration your signed-in Google account already has access to. Your Google credentials stay on your machine.
Does FireScan store my data?
FireScan does not store your application data, Google credentials, Firestore documents, Realtime Database contents, Storage files, or secret values. FireScan stores only the information needed to operate your account, such as authentication, subscription status, and scan usage.
Does FireScan receive my data?
FireScan receives a limited, normalized security snapshot needed to perform the audit. That snapshot contains security posture information such as deployed Rules, authentication settings, App Check status, Function configuration, and summarized IAM posture. It does not contain your Google credentials, application records, Storage objects, service-account private keys, or environment-variable values.
Does FireScan touch my configuration?
No. FireScan is read-only. It does not change your Firebase Rules, IAM permissions, Authentication settings, Functions, Storage configuration, or any other project settings. FireScan analyzes your current posture and provides recommendations; you decide whether to make any changes.
Can FireScan see my users’ data?
No. FireScan does not read your Firestore documents, Realtime Database records, Firebase Authentication user records, or Cloud Storage files. It analyzes security configuration, not customer content.
Can FireScan access my secrets or API keys?
FireScan does not collect secret values. For example, when reviewing Cloud Functions, it may identify configuration names that appear security-sensitive, but it does not transmit or analyze the underlying secret or environment-variable value.
Does FireScan need write access to my Firebase project?
No. FireScan is designed to operate using read-only access to security and configuration metadata. It does not need permission to modify your project.
What happens when I run a scan?
The FireScan CLI collects supported security configuration locally using your existing Google credentials. It converts that information into a limited security snapshot and sends the snapshot to FireScan’s private analysis engine. The engine evaluates the snapshot and returns your score, findings, evidence, and recommendations.
What permissions does FireScan need?
FireScan only needs your signed-in Google account to have enough access to read the relevant Firebase and Google Cloud configuration. If a particular area is not visible to your account, FireScan reports that coverage limitation rather than treating it as secure.
Will FireScan break my app?
No. Because FireScan does not modify your configuration or application data, running a scan should not affect your app, users, deployments, or Firebase resources.
Does FireScan guarantee that my Firebase project is secure?
No security scanner can guarantee that. FireScan is a security posture assessment tool designed to identify common risks, misconfigurations, and areas that deserve review. Its findings should be used alongside good development practices, testing, monitoring, and security review.
Why does FireScan sometimes report informational or medium-confidence findings?
Some security decisions depend on application intent that cannot be determined from configuration alone. FireScan distinguishes severity and confidence so you can tell the difference between a clear misconfiguration and something that deserves human review.
What does FireScan send to its servers?
Only the normalized security information required to perform the analysis. FireScan deliberately minimizes what leaves your machine and excludes credentials, application data, private keys, secret values, and unnecessary identity information.
How does FireScan decide whether something is a security issue?
FireScan uses defined security checks rather than generative AI. Each check evaluates specific configuration patterns or security posture signals—for example, public Storage access, overly broad Firestore Rules, App Check enforcement, IAM roles, or service-account posture. Findings are generated from those checks and include severity, confidence, evidence, and remediation guidance.
Use of AI
No AI in the scan path. FireScan does not use LLMs, generative AI, or autonomous agents to analyze customer projects. Security findings are produced by deterministic checks in FireScan’s private analysis engine.
Does FireScan use AI or autonomous agents to analyze my project?
No. FireScan does not use AI models, large language models, or autonomous agents as part of the scan process. Your security posture is evaluated by FireScan’s deterministic rules and scoring engine using predefined security checks.
Is my Firebase configuration sent to an AI provider?
No. FireScan does not send your security snapshot, Firebase configuration, project information, or scan results to an AI provider for analysis.
Can an AI model see my Firebase project or scan results?
No. AI models are not part of FireScan’s production scan pipeline. Your project configuration is collected locally, reduced to the security information required for analysis, and evaluated by FireScan’s private security engine.
Can FireScan make autonomous changes to my project?
No. FireScan does not use agents or automation that can modify your Firebase or Google Cloud environment. The scanner is read-only. It reports what it finds and leaves all remediation decisions and changes to you.
Why doesn’t FireScan use AI for security analysis?
FireScan is designed to produce repeatable, explainable results. The same configuration evaluated under the same scanning logic should produce the same finding, rather than depending on a probabilistic model response. This also keeps customer security configuration out of third-party AI systems.
