Open buckets: the folder the whole internet can read
Cloud storage buckets (Firebase Storage, Supabase Storage, S3-style folders) often default to public. If nobody changes the rules, anyone with the URL can list, read, or overwrite your users' files.
What can go wrong
When Firebase or Supabase storage rules say allow read, write: if true (or the Realtime Database equivalent ".read": true), the bucket is world-readable and often world-writable.
Builders enable "test mode" during development and forget to lock it down before launch. AI-generated configs frequently paste the permissive template because the app "needs to upload photos."
Verification selfies, government ID scans, chat attachments, and private messages in an open bucket are one guessed URL away from a headline.
It happened for real
In July 2025, the Tea App dating platform left Firebase Storage rules open. Forbes reported roughly 72,000 private images exposed, including about 13,000 verification ID photos, plus 1.1 million messages in an open Firestore collection (Forbes citing 404 Media, Jul 2025).
In May 2026, RedAccess scanned roughly 380,000 Lovable, Base44, Replit, and Netlify apps and found about 5,000 leaking sensitive data, with Axios-verified victims including medical and financial records (Axios, May 2026).
How to check yours
Seatbelt flags this automatically. Open Firestore rules (allow read, write: if true), open Firebase Realtime Database rules (".read": true), and equivalent wide-open storage configs in your repo are must-fix hard gates.
Honest hole: bucket-level "public" toggles set only in the Firebase or Supabase console may not appear in the repo export you hand us. Check the dashboard by hand.
Ask your agent: "Find every storage.rules, firestore.rules, and database.rules.json file. Flag any rule that allows read or write for all users. List file and line."
We don't catch this yet: Console-only bucket ACL changes with no rules file in the repo.
Fix direction
Replace open rules with owner-scoped checks (request.auth.uid == resource.data.userId or your stack's equivalent). Never ship test-mode rules to production.
Paste into your agent: "Audit Firebase and Supabase storage rules. Remove any if true read/write rules. Scope uploads and downloads to the signed-in user. Show me the before and after."