Checks · DB-005

DB-005 · Firestore or Realtime Database rules open

Why it matters

Rules that allow read and write for everyone expose the whole database.

How we detect it

Rules files are parsed, and a shallow public read is attempted when a database URL is public.

How we fix it

Require authentication and scope each read and write to the signed-in user.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-001 · Secret committed in repo (current tree)
• SEC-002 · Secret in git history
• SEC-003 · Service-role or secret key in client bundle
• SEC-004 · Public env prefix on a secret