https://shipreadyai.dev/learn/findings/o15-firebase-storage-open

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Firebase storage listed its contents without a sign in

A plain request to {endpoint} returned an object listing with no sign in, so anyone can enumerate what is stored.

## Why AI-built apps get this

Firebase ships with open rules while you build, and the console says so. Turning them into real rules is a separate task with no deadline attached, and the app behaves identically either way.

## Evidence line

GET https://example-app.firebaseio.com/.json returned 200 with data

## The fix

Close the storage rules to authenticated callers and serve public files through your own addresses.

## Prompt

Close the Firebase storage rules so listing and reading require an authenticated caller.