Firebase Realtime Database
Firebase Realtime Database (firebaseio.com) is a JSON document store with declarative security rules. When rules ship as `".read": true` (the default in many tutorials), anyone with the database name can dump the entire tree by appending `.json` to the URL.
Firebase Realtime Database exposure data
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
The vast majority of exposed Firebase RTDBs are mobile-app backends where the developer copy-pasted a tutorial security rule, shipped to production, and never revisited. The exposure is invisible from the Firebase console and only manifests when a third party tries the URL.
Real-world impact
Unauthenticated full-database read returns every record in the tree as one JSON blob. Many apps store PII, session tokens, or even credentials there. The same misconfig sometimes allows unauthenticated writes, turning a read leak into a data-tampering primitive.
Remediation
- Replace `".read": true` with `".read": "auth != null"` at minimum, scoped further by user id where possible.
- Test rules with `firebase emulators:exec --only database` before deploying.
- Audit existing rules with the Firebase Rules Playground for the `auth=null` case.
URL patterns
Firebase Realtime Database buckets typically resolve under hostnames like:
example-app.firebaseio.comexample-app-default-rtdb.firebaseio.com
Check a specific Firebase Realtime Database URL
Paste any Firebase Realtime Database URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed Firebase Realtime Database bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request