From the checkup catalog
A database table that answers without a login
What a one-row read means, and what it does not mean.
The checkup does not guess passwords and does not walk every table name. It asks a short list of common names, one row each, with the public key the app already ships.
A 200 response with a JSON array means the anon role can read that table. A 401 or an empty error means the policy held. The contents of the row are not kept.
Turn on row security or the matching rules for Firebase. Recheck that single table for free after you deploy the policy.