Firebase database anonymously readable
Scan rule · RSC-SEC-017
- Security
- Severity: Critical
- CWE-284
- OWASP A01-2021
Queries the Realtime Database endpoint with `shallow=true`: if it returns key names instead of “permission denied”, the database is open.
Scan tier
- External scan (anonymous)
How to fix it
Change security rules to require `auth != null` plus field-level conditions.