#3 of 10critical

Firebase databases anyone can read

Realtime Database or Firestore rules that let anyone read your data with no login.

Where it shows up: Firebase Realtime Database and Firestore

Last updated 18 October 2026

What it is

Like Supabase, Firebase apps read data straight from the browser with a public config. Security rules are what keep the data private.

Test mode rules, or rules written to get past a permission error, often allow reads for everyone. Those rules then ship to production unchanged.

What an attacker sees

With the public config in your site's code, anyone can read an open Realtime Database or Firestore collection directly, with no account and without using your app.

How to fix it

Paste this into your AI tool:

Paste the prompt below into your vibecoding tool

Security fix: my Firebase data is readable by anyone with no login. Update the Realtime Database and Firestore security rules so reads and writes require authentication, and scope each record to its owner (match request.auth.uid to the record's owner field) instead of letting any signed-in user read everything.

Firestore rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /profiles/{docId} {
      allow read, write: if request.auth != null && request.auth.uid == resource.data.ownerId;
    }
  }
}

Or by hand:

In the Firebase Console, open Firestore Database → Rules (and Realtime Database → Rules if you use it).
Replace any rule that allows reads with `true` or with no condition.
Publish the rules, then re-scan.

Check your app

Shippable reads your Firebase config from your site's code and asks as an anonymous visitor. For the Realtime Database it lists only the top-level key names. For Firestore it reads a single document and reports only its field names.

Scan your dev server before you push. No account needed:

Terminal

npx shippable-dev scan localhost:5173

Or scan your live app in the browser: