One of the main advantages of Firebase is virtually infinite scalability. You can be sure that if your website goes viral, it will stay responsive no matter the traffic. Also, thanks to generous free quotas, when there're not many visitors, your bill will be $0.
There's also a downside to this approach. If you get attacked or accidentally push code that consumes too many resources, your bill might significantly grow. Because there're virtually no limits, your disappointment at the end of the billing cycle also can be endless.
Thankfully, Firebase provides a handly budget limiting tool that allows you to protect your bank account.
You'll get to set up the budget page. There you'll be able to pick projects and the products (both Firebase and Google Cloud) affected by the budget. Specify the target amount and alerts, which will help you to know when exhausted, say 50%, 90%, and 100% of the budget. These alerts are configurable and also allow you to connect alarms to Pub/Sub and process those programmatically.
It sucks when your website gets to the front page of Reddit or Hacker News, and then your server struggles to serve your potential customers. It also sucks when you receive a bill you didn't expect. Luckily Firebase allows you to overcome the former and prevent the latter, but to be safe, you have to go and set up your budget now!