NewTrusted App · Data ExposureAI chat app left 300 million messages publicly readable
At a glance
- App
- Chat & Ask AI
- Root cause
- Public Firebase rules
- Scale
- 300M messages / 25M users
- Reported by
- Harry / Firehound
What happened
Codeway's legitimate AI chat app exposed its backend database because Firebase security rules allowed public access. Chat history and settings could be retrieved without signing in.
A scan of 200 iOS apps found 103 with the same Firebase mistake, showing a broad development problem rather than one isolated incident.
What was found
The database included chat logs, model preferences and settings, along with data connected to other apps from the same developer. The configuration was fixed within hours of disclosure.
Data at risk
- Shared backends
- User settings
- Model preferences
- Account data
- Chat history
- Personal prompts
What you should do
- Update the app to the latest version.
- Avoid entering highly sensitive information in AI chats.
- Check whether other apps from the developer share the same backend.
- Enable any additional sign-in protection the app supports.
View original postMalwarebytes · Firehound