---
title: Hire a Firebase Developer, Week One Is the Audit @ Varstatt
url: https://varstatt.com/x/teams/firebase-audit
description: Hire a Firebase developer, starting with a one-week audit of Firestore, security rules, functions and billing, top fix shipped. $997, one payment.
section: Services (https://varstatt.com)
---
# Firebase Audit for No Surprises

A one-week audit of Firestore, rules, functions and billing, top fix shipped: one payment of $997. Then hire me by the week.

**What's included:**

- ✅ Senior developer
- ✅ Full code ownership
- ✅ Done in one week
- ✅ One price, paid once
- ❌ Meetings overhead
- ❌ Scope creep
- ❌ Hourly billing
- ❌ Billing surprises

**Get started:**

- [Start a Project](https://varstatt.com/start?cta=agent)
- [Ask Jurij](mailto:jurij@varstatt.com)

## Portfolio

- **Free, AI-powered technical discovery & development roadmap in 15 minutes** — [varstatt.com/discovery](https://varstatt.com/discovery)
- **Initial launch of TenderPilot, an AI-powered tendering software for Australian SMEs** — [tenderpilot.ai](https://tenderpilot.ai)
- **Content Pal, a pay-per-use social media content scheduler for solo creators** — [contentpal.app](https://contentpal.app)
- **Fidder, a free & simple RSS reader that cuts through the noise and works everywhere** — [fidder.app](https://fidder.app)

## Firebase Problems and Their Fixes

- **The Bill Keeps Rising** Each line of the bill traced to the query, listener or function behind it.

- **Nobody Trusts the Rules** Every collection reviewed and tested as a hostile client.

- **Quota Errors Even on Blaze** Blaze lifts the caps, not the platform's limits. I find the one you hit.

- **The App Got Slow** Query paths mapped, the data model restructured where it's the cause.

- **Nobody Owns Firebase** After the audit, I can own the Firebase layer by the week.

## Week One Ends With a Report

| When | Step | What Lands |
|---|---|---|
| Day 1 | Billing | Reads, writes and deletes by collection, invocations, storage and egress |
| Then | Data Model and Rules | Indexes, read paths, listeners, rule coverage, sign-in flows |
| **Week 1 Ends** | The Report | What I found, what each finding costs, what to fix first |

## You Borrow Scars I Already Earned

| Area | Finding | Fix | Story |
|---|---|---|---|
| Rules | Rules looked up other documents; Firestore bills each lookup as a read | User data under the user's path: a one-line rule | [The story](https://varstatt.com/jurij/p/fidder-overengineering-made-me-pay) |
| Polling | A server polled the database whether anything had changed or not | Functions triggered by database events | [The story](https://varstatt.com/jurij/p/fidder-overengineering-made-me-pay) |
| Functions | Two function instances raced to create one paid resource | A Firestore transaction as the gate | [The story](https://varstatt.com/jurij/p/using-firestore-transactions-to-handle-race-conditions) |
| Listeners | A listener read new documents before their defaults were set: records born read-only | Every field written at creation | [The story](https://varstatt.com/jurij/p/three-ways-the-wrong-value-won) |

## Who It's For

**Right For**

- Web apps on Firebase, in JavaScript or TypeScript

- A surprise bill, a Google rules warning, a launch

- Teams about to hire a Firebase developer or consultant

**Better Elsewhere**

- Flutter or native mobile *A mobile developer*

- Another backend *A developer of that stack*

- Cloud Audit Logs or IAM reviews *A security firm*

- Several engineers at once *An agency*

## How It Works

A simple, predictable and transparent process that eliminates development headaches.

1. **Book** — Pay once; a task board opens, and you add me to the Firebase project, billing and repo.
2. **Setup** — Work starts the next working day. Everything stays in your accounts.
3. **Plan & Develop** — After the report you rank the fixes; if you keep me on, I take one at a time.
4. **Review & Refine** — Every change goes up for your review. I revise until you're satisfied.
5. **Progress** — You approve finished work. I move to the next fix, then to features.
6. **Maintain** — You report issues anytime; I handle them first.

## Pricing — One-Time

The audit week. Then stop, or hire me by the week.

- **Price:** $997
- **Note:** 1-week delivery
- **Plan:** A Firebase audit with its top fix, then by the week if you want.
- **Includes:**
  - 🧑‍💻 10+ years shipping software
  - 🗣️ Direct access to developer
  - 🪪 Full code & assets ownership
- **CTA:** [Get Started](https://varstatt.com/start?cta=agent)
- **Questions:** jurij@varstatt.com

## FAQ

### Why is our Firebase bill so high?

Usually reads, not traffic: whole-collection listeners, rules that look up other documents, polling. On my own app, fixing those [took the Firestore bill from about $12 to under $1 a month](/jurij/p/fidder-overengineering-made-me-pay).

### Can we cap Firebase spending?

Partly: budget alerts only warn, and Firestore has no spend cap. The report lists the limits your app needs.

### Are our Firestore security rules safe?

A security rules review asks one question: can a signed-in stranger read or write what they shouldn't? Rules usually fail three ways: left open from setup, a sign-in-only check, or a collection added later.

### Is our Firebase API key a leak?

Not on its own: Firebase web keys are public by design. An OpenAI or Gemini key in the browser is, so [those calls move behind Cloud Functions](/jurij/p/when-polish-over-security-costs-real).

### Should we move off Firebase?

Sometimes: Postgres fits heavily relational data better. More often the data model changes and [the platform stays](/principles/discovery/context-over-purity).

### Can you stay on after the audit?

Yes, by the week: fixes, then features on Firestore, Auth, Cloud Functions and Hosting, on my [default stack](/principles/delivery/default-stack).

### What if it isn't working out?

I revise the report until you're satisfied. Kept on by the week, [cancel anytime](/principles/partnership/exit-freedom) with no penalty.

### How do I get started?

Fill in the [project form](/start?cta=firebase-audit-faq) with what moved: the bill, a Google rules email or a slow screen. I reply the next working day.

## Testimonials

> "Jurij understand the core problem, insists on building the right experiences for the customers."
> — [Kunal Modi, Founder @ SOAPNoteAI](https://www.linkedin.com/in/jurijtokarski/details/recommendations/)

> "Working with Jurij is an absolute joy, consistently exceeds expectations."
> — [Janis Ozolins, Content Creator](https://x.com/OzolinsJanis/status/1875168034249146609)

> "Consistently delivered quality code in great time, very hard working & precise."
> — [Bartosz Poźniak, CEO @ MyCointainer](https://www.linkedin.com/in/jurijtokarski/details/recommendations/)

> "The kind of engineer that every company on the planet would be lucky to have."
> — [Hosam Mazawi, COO @ LemonUnit](https://www.linkedin.com/in/jurijtokarski/details/recommendations/)

## [Teams × Varstatt](https://varstatt.com/x/teams)

Firebase Audit fits product teams best: CTOs and tech leads who need a senior on one part of the product.

- **[React & Next.js Development](https://varstatt.com/x/teams/react-development)** "The upgrade keeps losing to features." Small pull requests, no big-bang rewrite.

- **[Node.js Development](https://varstatt.com/x/teams/nodejs-development)** "Backend work waits on a hire." Endpoints, integrations, an API being retired.

- **[AI Development](https://varstatt.com/x/teams/ai-development)** "Nobody here has shipped an LLM feature." A prototype on your data first.

- **[n8n Development](https://varstatt.com/x/teams/n8n-development)** "Our workflows have no owner." New flows, code where nodes stop, monitoring.

- **[App Maintenance](https://varstatt.com/x/teams/app-maintenance)** "An old app still has users and no owner." Kept current and safe.

- **Firebase Audit (this page)** "The bill keeps rising, or nobody trusts the rules." The bill tied to its code, every rule reviewed.

- **[DevOps Audit](https://varstatt.com/x/teams/devops-audit)** "Releases are slow and scary." Planning to monitoring, fixes ranked.

- **[Architecture Audit](https://varstatt.com/x/teams/architecture-audit)** "Every feature takes longer than the last." Why, what to fix first, whether a rewrite pays.

Not on a product team? [See what Varstatt offers you](https://varstatt.com/x).

## About

Varstatt is run by [Jurij Tokarski](https://varstatt.com/jurij), product engineer since 2011.

Contact: [jurij@varstatt.com](mailto:jurij@varstatt.com) / [X](https://x.com/jurijtokarski) / [LinkedIn](https://www.linkedin.com/in/jurijtokarski/)

Sole proprietorship headquartered in Rzeszów, Poland. VAT ID: PL8133854722.