https://news.ycombinator.com/item?id=37297823#37298972 https://news.ycombinator.com/item?id=37297823#37298972 Really what happened is we checked whether we cou

https://news.ycombinator.com/item?id=37297823#37298972 https://news.ycombinator.com/item?id=37297823#37298972 Really what happened is we checked whether we could set `isAdmin` to `true` on our existing accounts, and... we were able to. Adi's more technical writeup has details: https://saligrama.io/blog/post/firebase-insecure-by-default/ https://saligrama.io/blog/post/firebase-insecure-by-default/