Breaches and incidents
Zing Food (Gurugram, India): open Firebase database and unauthenticated APIs exposed every order
MediaNama reports the 10-minute food delivery startup’s Firebase database had no access rules, so anyone with the API key embedded in the app could read...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- MediaNama reports the 10-minute food delivery startup’s Firebase database had no access rules, so anyone with the API key embedded in the app could read all orders (customer names, phones, addresses, items, driver details) and, per one researcher, write to it; a second researcher found unauthenticated endpoints at dashboard.getzing.app. Number affected not given.
- Root cause: Firebase rules left open; login enforced only in the frontend.
- Attacker: none known; found by researchers Ujjwal Dimri and Jay Vasant.
- Response: an employee fixed the issue and said the app was shutting down; subdomain now 404.