Why it matters
Open Firebase rules mean anyone with your project ID, which is in your JavaScript, can read your data. Automated scanners look for open Firebase databases all the time.
How Patch checks
Only for sites you have proved you own. We use the Firebase config your site already publishes to ask the Realtime Database for a shallow read, ask a few common Firestore collections for one document, and ask Storage to list one file. We record only whether anything came back.
This check only runs once you verify you own the site. Until then the report lists it under "what we couldn't check".
How to fix it
- In the Firebase console, open the security rules for your database and storage.
- Replace any "allow read, write: if true" with rules that check request.auth, for example: allow read: if request.auth != null && request.auth.uid == userId.
- Use the Rules Playground to test signed-out access, then publish.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere.