Firebase endpoints did not answer an anonymous request

Firebase ships with open rules while you build, and the console says so. Turning them into real rules is a separate task with no deadline attached, and the app behaves identically either way.

The database and storage endpoints refused a request that carried no sign in.

GET https://example-app.firebaseio.com/.json returned 200 with data

Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.

Nothing to change here.

A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.

• Not verified

  First-quarter 2026 assessment of 200 apps

  183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.

  2026-04

  Read the incident
• Observed

  Moltbook records exposure

  An app exposed 4.75 million records, including 1.5 million API tokens and 35,000 email addresses.

  2026-01

  Read the incident
• Not verified

  Tea app, first breach

  An unprotected storage instance exposed tens of thousands of user images, including identity documents.

  2025-07

  Read the incident
• Not verified

  Tea app, second breach

  Three days after the first breach, over a million private messages were exposed through an API endpoint with no access control.

  2025-07

  Read the incident
• Observed

  Lovable-built apps, CVE-2025-48757

  Broken access control reported across 170 production applications built with Lovable.

  2025-05

  Read the incident

• storage bucket
• row level security
• evidence