Is your Firebase database open to the public?
Firebase makes it trivial to give your app a database â and just as trivial to leave that database open to the entire internet. It comes down to one thing: your Security Rules. Get them wrong and anyone can read your users' data without logging in. Here's the risk, what our scans and public research found, and how to check yours in seconds.
Check your Firebase app now
Paste your app's URL. The free scan checks from the outside whether your Firebase database is readable without a login. No signup, nothing changed.
Only scan apps you own or have permission for.The risk: one permissive Security Rule
Firebase security lives entirely in its Security Rules â the config that decides who can read and write your Firestore, Realtime Database and Storage. The trap is that Firebase config (the database URL and API key) is public by design: it ships in your app's frontend so the app can talk to the database. That's fine â the API key isn't the secret. Your rules are what protect the data.
The classic mistake happens during development: a rule gets set to allow all reads (something like ".read": true) to "make it work," and never gets locked down before launch. Because the database URL is public, anyone can then read the whole database directly â no login, no exploit. Just an open door with a public address.
We ran our scanner against 348,316 Firebase-backed apps and found more than 10,000 with a database readable without authentication. It's a small percentage â but a huge number of real apps exposing real user data.
Based on Firebase-backed apps we could reach and scan passively (read-only) from the outside, as of September 2026. Aggregate figures only; no individual app is identified.- High / critical 10,159 · 84%
- Medium 278 · 2%
- Low 1,637 · 14%
Severity of the apps we flagged, grouped by their most serious issue (critical counted as high). Passive, read-only scans of publicly-reachable apps, September 2026.
It's not just us. In March 2024, security researchers found Firebase misconfigurations exposing over 19.8 million secrets â plaintext credentials, API keys and more â and separate research traced the passwords of 1.8 million users to open Firebase databases across 900+ apps. This is one of the most common ways modern apps leak data.
What can go wrong in a Firebase app
Open read rules → anyone reads your database
The big one. Firestore or Realtime Database rules that allow reads without authentication return your data to anyone who has the (public) database URL.
Open write rules → anyone edits your data
Worse than reading: permissive write rules let strangers modify or delete records, or inject content into your app.
Exposed Storage buckets
Firebase Storage has its own rules. Left open, uploaded files â documents, images, user content â become publicly downloadable.
Missing browser protections
Security headers that harden the app itself. Minor next to open rules, but worth closing.
A Firebase API key (AIza...) showing up in your app is expected and not a secret â Firebase is designed that way. The thing that protects your data is your Security Rules, not hiding the key.
How to check your Firebase app
- In the Firebase console, review the Security Rules for Firestore, Realtime Database and Storage â anything allowing read/write without an auth condition is open.
- Since the database URL is public, confirm an unauthenticated request returns no data.
- Or run the free scan below, which checks from the outside whether your database answers without a login.
Is your Firebase database one of the open ones?
Find out in about 10 seconds. Free, no signup, read-only.
Only scan apps you own or have permission for.What to do if you find something
- Lock down your Security Rules. Require authentication to read or write any data that isn't meant to be fully public, for Firestore, Realtime Database and Storage.
- Never rely on hiding the config. The API key and database URL are public â your rules must do the protecting.
- Check Storage separately. Buckets have their own rules; don't assume database rules cover them.
- Re-scan to confirm your database no longer returns data without a login.
Is Firebase safe to use?
Yes â Firebase is secure when its rules are set correctly, and plenty of production apps run on it safely. The catch is that the default-open testing rules are one deploy away from exposing everything, and nothing warns you. Set your rules to require authentication, and your database is closed. The scan above tells you, in seconds, whether it already is.