Scan rule · RSC-SEC-017
Firebase database anonymously readable
SecuritySeverity: HighCWE-284OWASP A01-2021
Queries the Realtime Database endpoint with `shallow=true`: if it returns key names instead of “permission denied”, the database is open.
Scan tier
External scan (anonymous)
How to fix it
Change security rules to require `auth != null` plus field-level conditions.