We recently conducted a research around Misconfigured firebase endpoints, and the results are quite interesting.
We even ended up discovering 2 mobile apps which were logging the browser history of over 15 million users in plaintext on firebase.
cc: @silascutler@NSCUpdate