• 0 Posts
  • 4 Comments
Joined 2 years ago
cake
Cake day: July 20th, 2023

help-circle

  • My hey we’re probably using Firestore as their database without authenticating their api calls to firebase functions. Basically leaving their api endpoints open to the public Internet.

    They could have connected service account and used some kind of auth handshake between that and generate a temporary login token based on user credentials and the service account oauth credentials to access the api. but they probably just had everything set to unauthenticated