Firebase Storage allows anonymous object listing
ShipReady received an object-list response from the discovered Firebase Storage bucket without supplying credentials.
Why it matters
Anonymous listing can reveal what a bucket contains and may be inappropriate for user uploads or other non-public assets.
How ShipReady detects it
What it inspects
ShipReady extracts a Firebase Storage bucket reference from client content and sends one bounded unauthenticated list request with a one-item result limit.
What triggers a finding
The rule triggers when that request returns HTTP 200 with an items collection in the response.
What the evidence shows
The observed bucket responded to the scanner's anonymous object-list request with an items collection.
Limits of this check
ShipReady does not download an object, enumerate the entire bucket, inspect Firebase rules, or test write, delete, metadata, or authenticated access. Anonymous listing does not prove that every listed object can be downloaded.
How to fix it
Review Firebase Storage rules
Restrict reads and listing to the audience that needs them, using authentication and path-specific conditions where appropriate.
Separate public and private assets
Keep deliberately public assets in an intentionally public delivery path and place user or sensitive uploads behind the required authorization controls.
How to verify the change
Test the intended anonymous behavior
From a controlled unauthenticated client, verify that listing and reading are allowed only for the paths intended to be public.
Expected: Anonymous clients cannot list private paths and public paths follow the intended access rules.