Firebase security

Is your Firebase database open to the public?

Firebase makes it trivial to give your app a database — and just as trivial to leave that database open to the entire internet. It comes down to one thing: your Security Rules. Get them wrong and anyone can read your users' data without logging in. Here's the risk, what our scans and public research found, and how to check yours in seconds.

Check your Firebase app now

Paste your app's URL. The free scan checks from the outside whether your Firebase database is readable without a login. No signup, nothing changed.

Only scan apps you own or have permission for.

The risk: one permissive Security Rule

Firebase security lives entirely in its Security Rules — the config that decides who can read and write your Firestore, Realtime Database and Storage. The trap is that Firebase config (the database URL and API key) is public by design: it ships in your app's frontend so the app can talk to the database. That's fine — the API key isn't the secret. Your rules are what protect the data.

The classic mistake happens during development: a rule gets set to allow all reads (something like ".read": true) to "make it work," and never gets locked down before launch. Because the database URL is public, anyone can then read the whole database directly — no login, no exploit. Just an open door with a public address.

10,000+ open databases

We ran our scanner against 348,316 Firebase-backed apps and found more than 10,000 with a database readable without authentication. It's a small percentage — but a huge number of real apps exposing real user data.

Based on Firebase-backed apps we could reach and scan passively (read-only) from the outside, as of September 2026. Aggregate figures only; no individual app is identified.
12,074 FLAGGED
  • High / critical 10,159 · 84%
  • Medium 278 · 2%
  • Low 1,637 · 14%

Severity of the apps we flagged, grouped by their most serious issue (critical counted as high). Passive, read-only scans of publicly-reachable apps, September 2026.

It's not just us. In March 2024, security researchers found Firebase misconfigurations exposing over 19.8 million secrets — plaintext credentials, API keys and more — and separate research traced the passwords of 1.8 million users to open Firebase databases across 900+ apps. This is one of the most common ways modern apps leak data.

What can go wrong in a Firebase app

Data

Open read rules → anyone reads your database

The big one. Firestore or Realtime Database rules that allow reads without authentication return your data to anyone who has the (public) database URL.

Critical

Open write rules → anyone edits your data

Worse than reading: permissive write rules let strangers modify or delete records, or inject content into your app.

Storage

Exposed Storage buckets

Firebase Storage has its own rules. Left open, uploaded files — documents, images, user content — become publicly downloadable.

Minor

Missing browser protections

Security headers that harden the app itself. Minor next to open rules, but worth closing.

Good to know

A Firebase API key (AIza...) showing up in your app is expected and not a secret — Firebase is designed that way. The thing that protects your data is your Security Rules, not hiding the key.

How to check your Firebase app

Is your Firebase database one of the open ones?

Find out in about 10 seconds. Free, no signup, read-only.

Only scan apps you own or have permission for.

What to do if you find something

Is Firebase safe to use?

Yes — Firebase is secure when its rules are set correctly, and plenty of production apps run on it safely. The catch is that the default-open testing rules are one deploy away from exposing everything, and nothing warns you. Set your rules to require authentication, and your database is closed. The scan above tells you, in seconds, whether it already is.