Hacker News Reader

Yeah. Either entirely client-side or passing through a server naively. This is the inevitable result of having an "allow by default" security model in an API. Unfortunately, insecure defaults are a common theme with libraries targeted at JavaScript developers. GraphQL is another area I would expect to see these kinds of issues.

> with no custom server-side code at all

Could be a mix. Firebase also offers Firebase Functions which are callable functions in the cloud. That code is not public.

However, Firestore or Firebase realtime database both require the user to setup security rules. Otherwise all data can be read by anybody.

That's a pretty crazy set-up, but it can work if appropriate authorization rules are coded into the SQL schema on the backend.

Writing appropriate authz rules on the backend has to be made easy.