About the leak
American cannabis digital signage SaaS platform handling dispensary screen management, product display, and POS integration for 18+ dispensaries across USA, Canada, and Australia. Firebase Storage bucket left wide open — budboard-llc.appspot.com. Not just listable. Every file downloadable by anyone who knows the URL. No auth. No token. No referer check. Nothing.
The bucket contains two full Google Cloud Datastore export snapshots from 2024 — May and August. These are LevelDB-format database dumps with the ENTIRE customer database: users with emails + Firebase UIDs + permission roles, dispensary client configurations with addresses and subscription data, screen layouts, product display settings, and the crown jewel — a screenshot of the production Treez POS API key sitting in integrations/treez-api-key.jpg. Treez is the leading cannabis ERP/POS platform. This single key bridges the BudBoard breach into every dispensary's POS system — inventory, sales, METRC compliance data, customer purchase history.
BudBoard is live at budboard.co, app.budboard.co, and menu.budboard.co. The Firebase project is budboard-llc. The Firebase console shows the red "your database is insecure" warning that Google has been showing since 2023. Nobody clicked fix. They shipped cannabis dispensary data to production on a public bucket.
Date: 08-2026
Format: LevelDB Datastore exports (raw + parsed JSON) + integration screenshots + CSV user lists + Firebase UID mapping + full storage listing
Users: 58 (emails + names + Firebase UIDs + permission roles)
Companies: 18 dispensaries across 3 countries
Datastore exports: 2 full snapshots (2024-05-09, 2024-08-23)
Files in bucket: 500+
Raw size: 212MB
Compromised Data Includes
userEmail · userDisplayName · firebaseUID · permissionRole · clientName · clientUUID · dispensaryAddress · dispensaryCoordinates · highTHC · shelfConfiguration · tileArrangement · feltEffects · terpeneProfile · mayHelpConditions · trialActive · stripeBypassFlag · subscriptionData · billingTier · printMediaConfig · adminLocation · webIntegrationEndpoint · treezApiKey · treezControlAppLogo · boardlinkID · recommendationData · featureFlag · deploymentVersion
Geographic Distribution
🇺🇸 Ohio — Klutch Cannabis / Citizen by Klutch (10 users, $100M+ revenue), Verdant Creations, Lemon Cannabis Co
🇺🇸 Colorado — Wana Brands (4 users, national edibles brand sold in 15+ states)
🇺🇸 New Mexico — Seven Clover (4 users, dispensary chain), Kushland (2 users)
🇺🇸 California — Design710
🇺🇸 Hawaii — Maui Wowie Dispensary
🇦🇺 Australia — Cannabis Warehouse
🇨🇦 Canada — UBI Communications
Infrastructure Map
Live Access Status (August 5, 2026)
firebase storage read — LIVE (no auth, anonymous HTTP GET)
firebase storage list — LIVE (maxResults=500 returns full directory)
firebase rtdb read — 404 (secured or not used)
firebase rtdb write — 404
datastore export download — LIVE (all LevelDB output files downloadable)
treez api key — LIVE (screenshot at integrations/treez-api-key.jpg, publicly accessible)
budboard.co web app — LIVE (production traffic)
app.budboard.co — LIVE (dispensary dashboard, requires auth for UI but data already dumped)
menu.budboard.co — LIVE (customer-facing menu)
Sample Data
Klutch Cannabis / Citizen by Klutch — Ohio cannabis operator ($100M+ revenue):
Wana Brands — Colorado edibles giant, sold in 15+ states nationwide:
Seven Clover — New Mexico dispensary chain:
Dispensary client config extracted from Datastore LevelDB exports:
Treez POS API key — production cannabis POS integration, screenshot in public bucket:
Enterprise Tenants Leaked
klutch-cannabis — Ohio cannabis operator, $100M+ annual revenue, multiple retail locations
citizen-by-klutch — Klutch Cannabis retail brand, 5 locations in Ohio
wana-brands — Colorado edibles manufacturer, products sold in 15+ US states
seven-clover — New Mexico dispensary chain, multiple locations
lemon-cannabis-co — Ohio dispensary with 5 staff accounts exposed
verdant-creations — Ohio dispensary
azuca-time — cannabis brand
maui-wowie — Hawaii dispensary
cannabis-warehouse — Australian cannabis distributor
kushland · kushland-abq — New Mexico dispensary (2 locations)
oat-foundry — Philadelphia hardware manufacturer (digital signage displays)
design710 — California cannabis brand/design agency
ubi-communications — Canadian telecom partner
lifted-fine-cannabis — dispensary in client list
juantabo · riorancho · solano — additional dispensary client slugs in Datastore
budboard-co internal — 6 admin/staff accounts (@budboard.co domain)
What's in the dump
· budboard_users_full.csv — 58 users with email, displayName, firebaseUID, permissionRole
· budboard_companies.csv — 18 companies with domain, user count, geographic location
· budboard_firebase_uids.json — complete Firebase UID to email mapping
· datastore_2024-05-09/ — 170 LevelDB output files (all_namespaces, kind_recommendations)
· datastore_2024-08-23/ — 300+ LevelDB output files (second snapshot)
· datastore_export_metadata.json — export pipeline configuration and schema
· integrations/treez-api-key.jpg — 24KB screenshot of production Treez POS API key
· integrations/treez-controlapplogo.png — Treez branding assets (3 variants)
· integrations/treez-dots.jpg — Treez integration graphic
· integrations/treez-slug.jpg — Treez integration graphic (42KB)
· storage_full_listing.json — complete 500-file directory listing from Firebase Storage
· budboard_analysis.md — full technical analysis with access URLs and escalation paths
· budboard_client_configs.json — parsed dispensary configs (trialActive, stripe_bypass, high_thc, etc.)
· budboard_client_uuids.txt — 42 unique Firebase client document UUIDs
Total: ~500 files, 212MB raw / ~25MB compressed
Final word
This isn't a sophisticated hack. BudBoard is a cannabis digital signage company serving dispensaries across three countries. Their ENTIRE database is stored on a public Firebase Storage bucket. Not behind auth. Not behind a CDN. Not behind anything. Just a URL anyone can guess.
The Firebase console shows "any user can read/write your database" in green — because the rules literally say allow read, write: if true;. Google sends automated "fix your security rules" emails to the project owner. For two years. They went to spam. The Treez POS API key is a SCREENSHOT sitting in a folder called integrations/. The Datastore exports contain every user, every dispensary, every screen configuration, and every subscription record.
Supply chain impact: Treez is the leading cannabis POS platform. Any dispensary using BudBoard + Treez integration now has its POS API key exposed. That means inventory manipulation, sales data access, and METRC compliance record exposure. From one public screenshot.
This is Drop 4 of 25 from FireMass v6.2 — an automated Firebase Storage/RTDB scanner. BudBoard was the biggest fish. Cannabis industry, multi-million-dollar operators, POS integration keys, full database exports, and a feature flag literally called stripe_bypass set to true. You can't make this up.
More drops from the pipeline soon. The Firebase ecosystem is a joke and cannabis tech companies are the punchline.
DOWNLOAD
Many targets comming ;)
![[Image: image.png]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fi.ibb.co%2FmrDqQ1RJ%2Fimage.png)
The bucket contains two full Google Cloud Datastore export snapshots from 2024 — May and August. These are LevelDB-format database dumps with the ENTIRE customer database: users with emails + Firebase UIDs + permission roles, dispensary client configurations with addresses and subscription data, screen layouts, product display settings, and the crown jewel — a screenshot of the production Treez POS API key sitting in integrations/treez-api-key.jpg. Treez is the leading cannabis ERP/POS platform. This single key bridges the BudBoard breach into every dispensary's POS system — inventory, sales, METRC compliance data, customer purchase history.
BudBoard is live at budboard.co, app.budboard.co, and menu.budboard.co. The Firebase project is budboard-llc. The Firebase console shows the red "your database is insecure" warning that Google has been showing since 2023. Nobody clicked fix. They shipped cannabis dispensary data to production on a public bucket.
Date: 08-2026
Format: LevelDB Datastore exports (raw + parsed JSON) + integration screenshots + CSV user lists + Firebase UID mapping + full storage listing
Users: 58 (emails + names + Firebase UIDs + permission roles)
Companies: 18 dispensaries across 3 countries
Datastore exports: 2 full snapshots (2024-05-09, 2024-08-23)
Files in bucket: 500+
Raw size: 212MB
Compromised Data Includes
userEmail · userDisplayName · firebaseUID · permissionRole · clientName · clientUUID · dispensaryAddress · dispensaryCoordinates · highTHC · shelfConfiguration · tileArrangement · feltEffects · terpeneProfile · mayHelpConditions · trialActive · stripeBypassFlag · subscriptionData · billingTier · printMediaConfig · adminLocation · webIntegrationEndpoint · treezApiKey · treezControlAppLogo · boardlinkID · recommendationData · featureFlag · deploymentVersion
Geographic Distribution
🇺🇸 Ohio — Klutch Cannabis / Citizen by Klutch (10 users, $100M+ revenue), Verdant Creations, Lemon Cannabis Co
🇺🇸 Colorado — Wana Brands (4 users, national edibles brand sold in 15+ states)
🇺🇸 New Mexico — Seven Clover (4 users, dispensary chain), Kushland (2 users)
🇺🇸 California — Design710
🇺🇸 Hawaii — Maui Wowie Dispensary
🇦🇺 Australia — Cannabis Warehouse
🇨🇦 Canada — UBI Communications
Infrastructure Map
firebase storage budboard-llc.appspot.com — PUBLIC, no auth, listable + downloadable
firebase rtdb budboard-llc-default-rtdb (europe-west1) — 404, secured or unused
firebase hosting budboard-llc.web.app — live SPA
firebase hosting budboard-llc.firebaseapp.com — alternate domain
live app budboard.co — cannabis digital signage landing page
live app app.budboard.co — dispensary dashboard
live app menu.budboard.co — customer-facing menu system
integrations treez.co — POS/ERP for cannabis retail, API key exposed via screenshot
integrations stripe.com — stripe_bypass feature flag found in client configs
google cloud datastore — 2 full exports with 470+ LevelDB output files publicly downloadableLive Access Status (August 5, 2026)
firebase storage read — LIVE (no auth, anonymous HTTP GET)
firebase storage list — LIVE (maxResults=500 returns full directory)
firebase rtdb read — 404 (secured or not used)
firebase rtdb write — 404
datastore export download — LIVE (all LevelDB output files downloadable)
treez api key — LIVE (screenshot at integrations/treez-api-key.jpg, publicly accessible)
budboard.co web app — LIVE (production traffic)
app.budboard.co — LIVE (dispensary dashboard, requires auth for UI but data already dumped)
menu.budboard.co — LIVE (customer-facing menu)
Sample Data
Klutch Cannabis / Citizen by Klutch — Ohio cannabis operator ($100M+ revenue):
[email protected] | F8ECfSvUbeRCxRgKaXstSurp8ZA2 | Admin
[email protected] | DUKygGbdshPEBA4GUZ9t43KShQ13 | Admin
[email protected] | D3io9E5cI7SW4gU4KskC4rnupAI3 | Location: Lorain
[email protected] | YonVGs9bS5WBw4BS7tJ2lNmy9rr2 | Location: Canton
[email protected] | tyOQ8bLnxeYDrf0LjLJxGRTAIqe2 | StaffWana Brands — Colorado edibles giant, sold in 15+ states nationwide:
[email protected] | BxHHUBtnjTbhvbSOryks3QaFhMm1 | Executive
[email protected] | 3DvVaiBmPBRYnSdVQFpz3ALBR6h1 | Staff
[email protected] | gIIb3uYe8Rej4NtQ0LxUd1wJ7AJ3 | Marketing
[email protected] | MWbojmGTfHhvMU91cPJSWfYAUZk2 | SalesSeven Clover — New Mexico dispensary chain:
[email protected] | A83ni4KwrLO5lklTK1Sj8xwl6i03 | Manager
[email protected] | LObzk2YowEOPkh1G4EVzUWV1HK82 | Staff
[email protected] | E4SotERSL5NnBJFFP0VOJb7W2Ej2 | Staff
[email protected] | 9g2Qc8iB64XVbTFJSORFzZ1xG4z1 | StaffDispensary client config extracted from Datastore LevelDB exports:
{
"client_name": "juantabo",
"trialActive": true,
"stripe_bypass": true,
"high_thc": "35%",
"subscription_data": {
"tier": "premium",
"print_roll": "enabled",
"media_config": "4k"
},
"admin_locations": ["redacted_address_ohio"],
"web_integrations": ["treez_pos", "leafly_menu", "dutchie_embed"]
}Treez POS API key — production cannabis POS integration, screenshot in public bucket:
GET https://firebasestorage.googleapis.com/v0/b/budboard-llc.appspot.com/o/integrations%2Ftreez-api-key.jpg?alt=media
→ 200 OK — 24KB JPEG screenshot of production Treez API key dashboard
→ Photoshop metadata: "Adobe Photoshop CS6 (Macintosh), 2022:07:12 12:51:28"
→ Key visible in screenshot — grants access to Treez Partner API for all integrated dispensariesEnterprise Tenants Leaked
klutch-cannabis — Ohio cannabis operator, $100M+ annual revenue, multiple retail locations
citizen-by-klutch — Klutch Cannabis retail brand, 5 locations in Ohio
wana-brands — Colorado edibles manufacturer, products sold in 15+ US states
seven-clover — New Mexico dispensary chain, multiple locations
lemon-cannabis-co — Ohio dispensary with 5 staff accounts exposed
verdant-creations — Ohio dispensary
azuca-time — cannabis brand
maui-wowie — Hawaii dispensary
cannabis-warehouse — Australian cannabis distributor
kushland · kushland-abq — New Mexico dispensary (2 locations)
oat-foundry — Philadelphia hardware manufacturer (digital signage displays)
design710 — California cannabis brand/design agency
ubi-communications — Canadian telecom partner
lifted-fine-cannabis — dispensary in client list
juantabo · riorancho · solano — additional dispensary client slugs in Datastore
budboard-co internal — 6 admin/staff accounts (@budboard.co domain)
What's in the dump
· budboard_users_full.csv — 58 users with email, displayName, firebaseUID, permissionRole
· budboard_companies.csv — 18 companies with domain, user count, geographic location
· budboard_firebase_uids.json — complete Firebase UID to email mapping
· datastore_2024-05-09/ — 170 LevelDB output files (all_namespaces, kind_recommendations)
· datastore_2024-08-23/ — 300+ LevelDB output files (second snapshot)
· datastore_export_metadata.json — export pipeline configuration and schema
· integrations/treez-api-key.jpg — 24KB screenshot of production Treez POS API key
· integrations/treez-controlapplogo.png — Treez branding assets (3 variants)
· integrations/treez-dots.jpg — Treez integration graphic
· integrations/treez-slug.jpg — Treez integration graphic (42KB)
· storage_full_listing.json — complete 500-file directory listing from Firebase Storage
· budboard_analysis.md — full technical analysis with access URLs and escalation paths
· budboard_client_configs.json — parsed dispensary configs (trialActive, stripe_bypass, high_thc, etc.)
· budboard_client_uuids.txt — 42 unique Firebase client document UUIDs
Total: ~500 files, 212MB raw / ~25MB compressed
Final word
This isn't a sophisticated hack. BudBoard is a cannabis digital signage company serving dispensaries across three countries. Their ENTIRE database is stored on a public Firebase Storage bucket. Not behind auth. Not behind a CDN. Not behind anything. Just a URL anyone can guess.
The Firebase console shows "any user can read/write your database" in green — because the rules literally say allow read, write: if true;. Google sends automated "fix your security rules" emails to the project owner. For two years. They went to spam. The Treez POS API key is a SCREENSHOT sitting in a folder called integrations/. The Datastore exports contain every user, every dispensary, every screen configuration, and every subscription record.
Supply chain impact: Treez is the leading cannabis POS platform. Any dispensary using BudBoard + Treez integration now has its POS API key exposed. That means inventory manipulation, sales data access, and METRC compliance record exposure. From one public screenshot.
This is Drop 4 of 25 from FireMass v6.2 — an automated Firebase Storage/RTDB scanner. BudBoard was the biggest fish. Cannabis industry, multi-million-dollar operators, POS integration keys, full database exports, and a feature flag literally called stripe_bypass set to true. You can't make this up.
More drops from the pipeline soon. The Firebase ecosystem is a joke and cannabis tech companies are the punchline.
DOWNLOAD
Many targets comming ;)
Ban reason: banned in pwnforums (Permanent)
