Apps with a Firebase Storage bucket

What this finding means

Firebase Storage holds files rather than records: user uploads, profile images, attachments, exported documents. An app using it ships a bucket name, which is enough to construct download URLs.

We have recorded a Storage bucket in 4,096 apps, making it the most common cloud reference in the corpus. That is unsurprising: almost any app that lets a user upload a photo acquires one.

Storage rules are not your database rules

The mistake specific to this product is assuming one configuration covers both. Firebase Storage has its own rules document, entirely separate from Realtime Database and Firestore rules. Securing the database does nothing for the bucket, and a project with careful database rules and untouched storage rules is an ordinary thing to find.

The second pattern is treating the bucket as a CDN. Serving public images is a legitimate use and the quickest route to it is a rule allowing all reads. That is fine for those images and not fine for everything else in the same bucket, because such a rule rarely stays scoped to the prefix it was written for.

Files also carry more than their contents. Photographs retain EXIF metadata including GPS coordinates and device identifiers unless stripped, so a readable image directory can disclose where your users have been.

How to fix it

• Review storage.rules separately from your database rules, and assume they have never been looked at.
• Scope rules by path: keep public assets under a prefix that is explicitly public and require authentication everywhere else.
• Key user uploads by the authenticated uid and require request.auth.uid to match the path.
• Validate size and content type on write, or an open bucket becomes someone else's file host at your expense.
• Strip EXIF from user images during upload rather than trusting clients to do it.

How we detect it, and what it cannot tell you

The bucket name is matched in the APK and recorded in redacted form. A reference is low severity, because referencing a bucket says nothing about who may read it.

A finding escalates only when an anonymous request confirmed the bucket answers one, with a stored record of that check. Nothing in the bucket is ever retrieved or kept: the check establishes that it responded, not what it holds.