Report a vulnerability
Report it privately through GitHub’s private vulnerability reporting on the Firenook repository. Only the maintainers see the report, and you can follow the fix there.
Include what you can:
- The Firenook version (
npx firenook --version) and your platform. - What an attacker can do, and what they need first: network access to a port, a file in your project, a crafted request.
- The smallest project or request that shows it, with synthetic data.
Please don’t open a public issue for a vulnerability, and never paste secrets, real user data, exports or private logs into a report.
What Firenook protects, and what it doesn’t
Firenook is a local development emulator. It is not a production database, and it is not a network sandbox. Its emulators answer without authentication, as the official ones do, so they are built for your machine:
- By default every emulator listens on
127.0.0.1only. Starting it with--host 0.0.0.0exposes the unauthenticated emulators to your network; do that only on a network you trust. - The console answers only for
localhost, loopback addresses, names underlocalhostand the host you started it on, unless you allow more with--allowed-hosts. - Your Functions code runs with your user’s rights and can reach the network. Firenook gives it the emulators’ addresses and no Google credentials, but code that loads credentials itself can still reach a real project.
In scope: anything that lets a web page, another user on your machine, or a request to a port Firenook opened on loopback do more than the emulator should allow, read files outside the project, or run code. Out of scope: what anyone can do once you expose the emulators to an untrusted network, and vulnerabilities in your own code or dependencies.
Releases and dependencies
Every release is published from GitHub Actions with npm provenance, so you can check that a package was built from the tagged source: npm audit signatures verifies it after an install. Each release names the engine revision it was built from. Versions and verification has the details.
The npm package installs JavaScript dependencies for its Functions host. Advisories in them are reviewed and recorded in the repository’s SECURITY.md; Firenook does not claim a dependency tree with no advisories.
Last changed on .