Can Firebase apps be hacked?

Firebase apps can be compromised if security rules are misconfigured, which is a widespread issue. Since Firebase configuration including the API key and project ID is embedded in client-side code, attackers can discover your project details and interact with your database directly using the Firebase SDK or REST API. Without proper security rules, an attacker can read all user data, modify records, or delete entire collections. Insecure Cloud Functions can also be exploited if they lack proper input validation or authentication. UNPWNED performs bounded anonymous-access and public-endpoint checks using public client configuration and reports confirmed exposure. Complete rule, validation, and authorization correctness requires Firebase-side review.