101 ways to secure your AI Logic implementation

[00:00:02][music] >> When talking about Firebase AI logic, a question that I often get is how do I take this to production in a secure way?

[00:00:13]Well, I have prepared 101 tips to help you do that, which in binary is just like five tips.

[00:00:22]Uh, let's go through them all.

[00:00:24]Tip number one, use Firebase App Check with limited use tokens and enforce it.

[00:00:31]Normally, App Check uses session tokens that last 30 minutes to 7 days, which is your baseline protection.

[00:00:39]But for AI, you want replay protection.

[00:00:42]By setting use limited use App Check tokens to true, every request gets a freshly minted token that gets consumed instantly upon validation.

[00:00:53]This means that even if someone managed to intercept your App Check token, they cannot reuse it.

[00:00:58]>> [music] >> Tip number two, use Firebase authentication and turn on authentication only mode.

[00:01:05]With this project-wide setting enabled, the Firebase AI logic proxy rejects any request that doesn't contain valid Firebase authentication credentials.

[00:01:15]It's a simple toggle in the console, but be careful.

[00:01:18]If you have older client versions in the wild that are unauthenticated, they will instantly start getting 401s for your AI logic feature. So, roll this out carefully.

[00:01:29]Tip number three, use server prompt templates if you can.

[00:01:33]Hardcoding prompts in client apps can be a liability.

[00:01:37]Users can decompile your binary to extract your prompt designs or even send arbitrary prompts from the client to the server.

[00:01:45]By keeping prompts on the server, you only expose a template ID like invoice template V1 and save variables like customer name.

[00:01:55]Plus, you can update your system instructions or the model you want to use instantly.

[00:02:01]Number four, if you're relying on server prompt templates, why not turn on template-only mode?

[00:02:07]This is where the magic happens.

[00:02:09]Once you have server prompt templates set up for all of your features, you can flip this toggle to block all direct calls to the model.

[00:02:17]This locks down your backend so that malicious users can't use your billing credits to misuse your app for their own purposes, like generating their own text, running mad on work, or spamming the model.

[00:02:29]It forces every incoming request to stick strictly to your predefined templates.

[00:02:35]Tip number five, turn on AI monitoring. You can't secure what you can't see. Enabling AI monitoring gives you a full dashboard showing latency, error rates, and token counts.

[00:02:47]More importantly, you can inspect individual traces in the Google Cloud Console to see exactly what prompts are coming in and what responses are generated.

[00:02:57]And if you're worried about PII, you can easily set up exclusion filters to keep your user logs private.

[00:03:04]Oh, and one more thing.

[00:03:07]Starting early July 2026, when you get started with AI logic, we automatically turn on and enforce App Check for you.

[00:03:15]This means you have to configure an App Check provider in your code.

[00:03:20]During development, you can use the App Check debug provider, but before you ship your new AI feature to production, you need to register your app with an actual App Check attestation provider so that your end users can use the feature when App Check is enforced.

[00:03:35]And this were 110 ways to secure your AI logic implementation.

[00:03:43]Thanks for watching and stay safe.

[00:03:47]>> [music] [music] >> Mhm.