900 Sites, 125 million accounts, 1 vulnerability

900 Sites, 125 million accounts, 1 vulnerability

Google's Firebase development platform encourages building applications (mobile an web) which talk directly to the underlying data store, reading and writing from "collections" with access protected by Firebase Security Rules.

Unsurprisingly, a lot of development teams make mistakes with these.

This post describes how a security research team built a scanner that found over 124 million unprotected records across 900 different applications, including huge amounts of PII: 106 million email addresses, 20 million …

applications building data data store development development platform firebase google mistakes mobile platform reading rules security store talk teams vulnerability web writing