Hacker News Reader

I found this story about the same situation (linked from the OP) easier to follow: https://saligrama.io/blog/post/firebase-insecure-by-default/

Adi's writeup is great, and goes much more into the technical detail than my transcript. I really recommend everyone checks out his post.