Firebase is Google’s backend-as-a-service platform. Firebase Realtime Database stores data and exposes it through a REST API. Access to the database is controlled by security rules — a JSON configuration that specifies who can read and write which data.
At the time, Firebase’s default rule when creating a new database was: { “rules”: { “.read”: true, “.write”: true } } — open read/write access for anyone, with no authentication required. This was the template shown during database setup.
Developers created databases using the default rules for rapid prototyping — and never changed them before shipping.
Firebase changed their default rules in 2019 to require authentication. But this incident illustrates a systemic API8 pattern: when the default is insecure and there is no enforced review step before deployment, misconfigurations proliferate at scale. The bug wasn’t in any single developer’s code — it was in the default that 2,446 developers never changed.