Firebase Realtime Database returned top-level keys anonymously
ShipReady received a non-empty object from a bounded unauthenticated Firebase Realtime Database shallow-read request.
Why it matters
A database that returns records to anonymous requests should be intentional and limited to data designed for public access.
How ShipReady detects it
What it inspects
ShipReady discovers a Firebase Realtime Database URL in page or script content, then sends one unauthenticated shallow REST read to its root.
What triggers a finding
The rule triggers only when the request returns HTTP 200 and a non-empty JSON object other than a lone error object.
What the evidence shows
The database returned a non-empty set of top-level keys to the scanner's unauthenticated shallow request. The report records the count, not key names or values.
Limits of this check
ShipReady does not retrieve record values, enumerate all paths, test writes, inspect Firebase rules, or determine which records are sensitive. It does not prove every database path is readable or writable.
How to fix it
Review Realtime Database rules
Restrict reads to the intended audience and use authentication and path-level conditions for private or user-specific data.
Separate intentionally public data
Keep public content in deliberately public paths and protect application or user data with narrow rules.
How to verify the change
Repeat a controlled anonymous shallow read
Verify private roots and paths return the intended permission response without retrieving real user data.
Expected: Anonymous clients can read only intentionally public database paths.