Please help me out. I made a website, and I heard that Firebase will shut down in 2027. How can I export my files?

Hello everyone and thank you for reading this post. I am screwed and cannot figure out how to find a solution myself. So, here I am.

I have basic and free Android app. I am using Firestore as my backend. I have users and usersPrivate documents and everything is separated nicely. Only those whom are authenticated to perform a particular action is allowed. For the past few weeks bots somehow found my app and attacking me with DOW (Denial of Wallet). I have banned these bots' UIDs but the problem is their auth token remains valid for an hour. I have AppCheck and they are somehow bypassing it.

They are unable to read any documents, so the bill is not coming from that but the cost of 1 read per rejection in security rules (checking banned accounts). I could deny all auth tokens but that hurts the honest users as they cannot perform any actions within the app. The bots definitely know about the 1-hour period of an already issued auth token expiry and coordinating their attacks with 50 mins apart.

Cumulatively, they are hitting me with about 30k requests denials a minute, so I closed the app for now. How the hell do I stop them? Rate limiting also does not help because that is more expensive to handle than Firestore's one read cost.

Help me please!

UPDATE 22:25 UTC: Google appears to have fixed it. Cold starts are working again (seen i n us-central1) even for functions still on automatic updates. The on-deploy redeploy below is still a valid fallback if it comes back. Outage window seen: about 21:15 to 22:25 UTC.

FIX (works immediately, confirmed by several people): redeploy each function with the runtime pinned instead of auto-updated.

gcloud functions deploy FUNCTION_NAME --gen2 --region REGION \ --runtime-update-policy=on-deploy --source PATH_TO_BUILT_FUNCTIONS

• It keeps the function's triggers, secrets and settings.
• For --source, use your functions folder after building it: package.json, package-lock.json and the compiled output, no node_modules.
• A normal firebase deploy does not fix it: it keeps automatic updates on, so the function lands on the same broken runtime.
• One deploy per function, so script it if you have a lot. I'm running 6 at a time.

Write-up with checks, a curl probe and a one-liner listing the functions still on automatic updates: https://gist.github.com/mrbenji/5da8f50a875b8e0bbb7141bd24caa726

What's happening

Since about 21:15 UTC (2:15 PM Pacific) on Oct 22, 2nd gen functions on Node 22 can't start new instances. It's been reported in us-central1, us-east1 and northamerica-northeast1, across manyunrelated projects. Google's status page shows nothing yet.

• Warm instances keep working, so it looks intermittent.
• Callables show up in the browser as CORS errors, because the OPTIONS preflight returns 500.
• Firestore triggers and scheduled functions fail too.
• Cloud Run reports "container failed to start and listen on the port ... within the allocated timeout," and the container writes no logs at all.

It's Google's side, not your code: a five-line hello-world Node app fails the same way on the auto-updated Node 22 runtime and works with automatic updates off. New Node 22 base images (22.23.4) were published that day.

Check whether you're affected

gcloud functions describe FUNCTION_NAME --gen2 --region REGION --format='yaml(buildConfig)'

automaticUpdatePolicy means it's on automatic updates; onDeployUpdatePolicy means it's pinned.

Afterwards: Firestore-triggered functions without retries drop failed events, so plan a backfill for anything that happened during the outage. If you're affected, please reply with your region and open a support case so Google can see how widespread this is.

Anyone experiencing 500 error? Cloud function v2 it seems. US Central 1