SEC-047
Firebase Storage bucket can be listed by anyone
HighDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Finds the storage bucket in the page’s Firebase config and asks the Storage API to list one file without signing in.
Why it matters
Anyone can enumerate and download every uploaded file, such as profile photos, documents and exports.
Recommended fix
Require authentication in storage.rules and scope reads to the owner of each file.
How to verify
Request https://firebasestorage.googleapis.com/v0/b/<bucket>/o in a private window and confirm a 403.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-047: Firebase Storage bucket can be listed by anyone
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Rewrite the Firebase Storage security rules so listing and reading require authentication and users can only access their own folder. Show the new storage.rules.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request https://firebasestorage.googleapis.com/v0/b/<bucket>/o in a private window and confirm a 403.