Can Firebase apps be hacked?

Firebase apps can be compromised if security rules are misconfigured, which is a widespread issue. Since Firebase configuration including the API key and project ID is embedded in client-side code, attackers can discover your project details and interact with your database directly using the Firebase SDK or REST API. Without proper security rules, an attacker can read all user data, modify records, or delete entire collections. Insecure Cloud Functions can also be exploited if they lack proper input validation or authentication. UNPWNED identifies these vulnerabilities by testing your Firebase endpoints for unauthorized access patterns.