SEC-046
Firebase Realtime Database is publicly readable
CriticalDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Finds the Realtime Database URL in the page’s Firebase config and requests /.json?shallow=true (top-level key names only) without signing in.
Why it matters
Anyone can download the whole database: user records, messages, orders. This is the most common data leak in Firebase apps.
Recommended fix
Replace ".read": true rules with rules that require auth and limit each user to their own data.
How to verify
Open <database URL>/.json?shallow=true in a private window and confirm "Permission denied".
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-046: Firebase Realtime Database is publicly readable
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Rewrite the Firebase Realtime Database security rules so nothing is readable without authentication and each user can only read their own records. Show me the new database.rules.json and how to deploy it.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Open <database URL>/.json?shallow=true in a private window and confirm "Permission denied".