[{"data":1,"prerenderedAt":181},["ShallowReactive",2],{"content:\u002Fguides\u002Ffirebase-content-moderation":3,"ArticleBody_cx3r8nVomAylAIpijVrnIAlhcLenDmODVgPT3WSyjVM":176},{"kind":4,"path":5,"locale":6,"title":7,"htmlTitle":8,"description":9,"navTitle":7,"published":10,"updated":10,"alternates":11,"breadcrumbs":12,"indexable":20,"twin":21,"collection":22,"slug":23,"file":24,"content":25,"hub":18,"titleEm":27,"eyebrow":28,"lead":29,"cta":27,"faq":30,"faqJsonLd":46,"sources":52,"related":154,"topic":27,"jsonLdType":174,"blocks":175,"shortDefinition":27,"feed":20},"article","\u002Fguides\u002Ffirebase-content-moderation","en","Firebase content moderation: Firestore messages and Storage uploads","Firebase Content Moderation: Cloud Functions · Detectivision","Moderate Firebase messages and uploads: a Cloud Function sends each new text or image to a moderation API and keeps it hidden until it is approved. With code.","2026-10-16T18:00:00+03:00",[],[13,16,19],{"name":14,"path":15},"Home","\u002F",{"name":17,"path":18},"Guides","\u002Fguides",{"name":7,"path":5},true,"\u002Fguides\u002Ffirebase-content-moderation.md","guides","firebase-content-moderation","content\u002Fen\u002Fguides\u002Ffirebase-content-moderation.md",{"collection":26,"path":5},"guides_en",null,"Guide","Two Cloud Functions and two rule files, plus an optional async path with a webhook. The code was type-checked and run in the Firebase emulators on 16 October 2026.",[31,34,37,40,43],{"q":32,"a":33},"Is this an official Firebase Extension?","No. It is your own Cloud Functions code that calls the Detectivision API over HTTPS. You deploy, update and pay for the functions in your Firebase project like any other function, and you can change every line.",{"q":35,"a":36},"Why does my Firestore query fail after adding these rules?","Security rules are not filters: a query that could return a message the reader may not see fails as a whole. Ask only for what the rules allow, such as where(\"status\", \"==\", \"approved\"), or the reader's own messages with where(\"authorId\", \"==\", uid). In the emulator test, the query without a filter failed and both of these passed.",{"q":38,"a":39},"Why does getSignedUrl fail inside my Cloud Function?","Without a key file, signing goes through the IAM signBlob permission. Enable the IAM Service Account Credentials API and give the functions' service account the Service Account Token Creator role (roles\u002Fiam.serviceAccountTokenCreator), as Google Cloud's signed URL guide describes.",{"q":41,"a":42},"Does a download URL stop working when an image is rejected?","Only when the file is gone or its token is revoked. getDownloadURL returns a long-lived URL with a revocable token, and in the emulator test that URL opened without any sign-in. That is why the function deletes a rejected file instead of only marking it.",{"q":44,"a":45},"Can I run this on the Spark plan?","Not deployed: Firebase requires the Blaze plan to deploy Cloud Functions (as read on 16 October 2026). On any plan you can run the functions and rules in the Firebase emulators, and text checks work from there. Image checks need a URL the API can download, which a file in the local Storage emulator does not have.",[47,48,49,50,51],{"q":32,"a":33},{"q":35,"a":36},{"q":38,"a":39},{"q":41,"a":42},{"q":44,"a":45},[53,58,61,64,67,70,73,76,79,82,85,88,91,94,98,101,104,107,111,115,119,123,127,130,133,136,139,142,145,148,151],{"title":54,"url":55,"publisher":56,"accessed":57},"Cloud Firestore triggers","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Ffunctions\u002Ffirestore-events","Firebase","2026-10-16",{"title":59,"url":60,"publisher":56,"accessed":57},"Cloud Storage triggers","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Ffunctions\u002Fgcp-storage-events",{"title":62,"url":63,"publisher":56,"accessed":57},"Configure your environment (secret parameters)","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Ffunctions\u002Fconfig-env",{"title":65,"url":66,"publisher":56,"accessed":57},"Get started: write, test, and deploy your first functions","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Ffunctions\u002Fget-started",{"title":68,"url":69,"publisher":56,"accessed":57},"Firebase Admin Node.js SDK release notes (Version 14.0.0: Node.js 18 and 20 dropped)","https:\u002F\u002Ffirebase.google.com\u002Fsupport\u002Frelease-notes\u002Fadmin\u002Fnode",{"title":71,"url":72,"publisher":56,"accessed":57},"Retry asynchronous functions","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Ffunctions\u002Fretries",{"title":74,"url":75,"publisher":56,"accessed":57},"Manage functions (timeouts)","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Ffunctions\u002Fmanage-functions",{"title":77,"url":78,"publisher":56,"accessed":57},"Securely query data","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Ffirestore\u002Fsecurity\u002Frules-query",{"title":80,"url":81,"publisher":56,"accessed":57},"Get started with Cloud Firestore Security Rules","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Ffirestore\u002Fsecurity\u002Fget-started",{"title":83,"url":84,"publisher":56,"accessed":57},"Index types in Cloud Firestore","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Ffirestore\u002Fquery-data\u002Findex-overview",{"title":86,"url":87,"publisher":56,"accessed":57},"Use conditions in Firebase Cloud Storage Security Rules","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Fstorage\u002Fsecurity\u002Frules-conditions",{"title":89,"url":90,"publisher":56,"accessed":57},"Learn the core syntax of the Firebase Security Rules for Cloud Storage language","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Fstorage\u002Fsecurity\u002Fcore-syntax",{"title":92,"url":93,"publisher":56,"accessed":57},"FirebaseStorage Framework Reference: StorageReference.downloadURL","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Freference\u002Fswift\u002Ffirebasestorage\u002Fapi\u002Freference\u002FClasses\u002FStorageReference",{"title":95,"url":96,"publisher":97,"accessed":57},"V4 signing process with Cloud Storage tools","https:\u002F\u002Fdocs.cloud.google.com\u002Fstorage\u002Fdocs\u002Faccess-control\u002Fsigning-urls-with-helpers","Google Cloud",{"title":99,"url":100,"publisher":97,"accessed":57},"Signed URLs","https:\u002F\u002Fdocs.cloud.google.com\u002Fstorage\u002Fdocs\u002Faccess-control\u002Fsigned-urls",{"title":102,"url":103,"publisher":97,"accessed":57},"Introduction to service identity","https:\u002F\u002Fdocs.cloud.google.com\u002Frun\u002Fdocs\u002Fsecuring\u002Fservice-identity",{"title":105,"url":106,"publisher":97,"accessed":57},"Functions best practices","https:\u002F\u002Fdocs.cloud.google.com\u002Ffunctions\u002Fdocs\u002Fbestpractices\u002Ftips",{"title":108,"url":109,"publisher":110,"accessed":57},"Content Moderation with Cloud Functions for Firebase (2 June 2017)","https:\u002F\u002Ffirebase.blog\u002Fposts\u002F2017\u002F06\u002Fcontent-moderation-with-cloud-functions","Firebase Blog",{"title":112,"url":113,"publisher":114,"accessed":57},"firebase\u002Ffunctions-samples (Node-1st-gen\u002Ftext-moderation and moderate-images)","https:\u002F\u002Fgithub.com\u002Ffirebase\u002Ffunctions-samples","Firebase on GitHub",{"title":116,"url":117,"publisher":118,"accessed":57},"App Review Guidelines, 1.2 User-Generated Content","https:\u002F\u002Fdeveloper.apple.com\u002Fapp-store\u002Freview\u002Fguidelines\u002F","Apple",{"title":120,"url":121,"publisher":122,"accessed":57},"Detectivision API status (GET \u002Fapi\u002Fv1\u002Fstatus)","https:\u002F\u002Fapi.detectivision.ai\u002Fapi\u002Fv1\u002Fstatus","Detectivision",{"title":124,"url":125,"publisher":126,"accessed":57},"Text moderation","https:\u002F\u002Fdetectivision.ai\u002Fdocs\u002Ftext","Detectivision docs",{"title":128,"url":129,"publisher":126,"accessed":57},"Image moderation","https:\u002F\u002Fdetectivision.ai\u002Fdocs\u002Fimage",{"title":131,"url":132,"publisher":126,"accessed":57},"Flags","https:\u002F\u002Fdetectivision.ai\u002Fdocs\u002Fflags",{"title":134,"url":135,"publisher":126,"accessed":57},"Responses","https:\u002F\u002Fdetectivision.ai\u002Fdocs\u002Fresponses",{"title":137,"url":138,"publisher":126,"accessed":57},"Async requests","https:\u002F\u002Fdetectivision.ai\u002Fdocs\u002Fasync",{"title":140,"url":141,"publisher":126,"accessed":57},"Webhooks","https:\u002F\u002Fdetectivision.ai\u002Fdocs\u002Fwebhooks",{"title":143,"url":144,"publisher":126,"accessed":57},"Credits and billing","https:\u002F\u002Fdetectivision.ai\u002Fdocs\u002Fcredits",{"title":146,"url":147,"publisher":126,"accessed":57},"Errors","https:\u002F\u002Fdetectivision.ai\u002Fdocs\u002Ferrors",{"title":149,"url":150,"publisher":126,"accessed":57},"Metadata and actions","https:\u002F\u002Fdetectivision.ai\u002Fdocs\u002Factions",{"title":152,"url":153,"publisher":126,"accessed":57},"Authentication","https:\u002F\u002Fdetectivision.ai\u002Fdocs\u002Fauthentication",[155,159,163,167,170],{"path":156,"title":157,"description":158},"\u002Fguides\u002Fsupabase-content-moderation","Supabase content moderation: Edge Functions, Storage and RLS","Check Supabase posts and uploads in an Edge Function, keep them hidden with row-level security until approved, and take results by webhook. With code.",{"path":160,"title":161,"description":162},"\u002Fguides\u002Fcontent-moderation-system-design","How to design a content moderation system: checks, rules and queues","A reference design for moderating user content: where to check, when to block or hold, how to route doubtful cases to people, and how decisions reach your app.",{"path":164,"title":165,"description":166},"\u002Fguides\u002Fapp-store-guideline-1-2","How to fix an App Store Guideline 1.2 user-generated content rejection","Apple's Guideline 1.2 asks UGC apps for four things: filtering, reporting, blocking and contact details. How to fix each, and what to tell App Review.",{"path":168,"title":140,"description":169},"\u002Fdocs\u002Fwebhooks","Get events at your own URL as they happen. Finished checks, flagged checks, failed async checks and actions, signed with your endpoint's secret.",{"path":171,"title":172,"description":173},"\u002Ftoxicity-detection-api","Toxicity detection","Check comments and chat messages for insults, hate, harassment and self-harm in ten languages, with a flag for each kind of toxicity.","TechArticle",false,["Island",177],{"key":178,"result":179},"ArticleBody_cx3r8nVomAylAIpijVrnIAlhcLenDmODVgPT3WSyjVM",{"head":180},{},1792166153978]