What are the most common Firebase security mistakes?

The most common mistake is leaving test mode security rules in production, which grants full read and write access to everyone. Other frequent issues include using allow read, write: if true in rules, not validating data structure in write rules, and exposing Cloud Function endpoints without authentication. Developers also commonly store sensitive data in the Realtime Database without encryption and fail to implement proper user data isolation in multi-tenant applications. UNPWNED detects these common misconfigurations by testing your Firebase project externally and reporting each vulnerability with remediation steps.