All data transmission happens over secure communication channels (over HTTPS)
An unauthorized remote attacker can perform brute force attacks to login into any user's account and perform a full account takeover.
An attacker (malicious app of attacker required on user's phone) can potentially access user data due to insecure Firebase services.
The app allows the users to edit their information in the app and delete their account.