Firebase Security Rules checklist for AI-built apps

1. Find open rules

Firebase Console → Firestore → Rules, Realtime Database → Rules, Storage → Rules. Red flags: allow read, write: if true; '.read': true / '.write': true; and test-mode rules that grant everything until a date (request.time < timestamp.date(...)).

2. Require auth and ownership

Scope documents to the signed-in user:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId}/{document=**} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
  }
}

3. Lock down Cloud Storage

Same idea for files:

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /users/{userId}/{allPaths=**} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
  }
}

4. Validate writes

Rules can check the shape of incoming data (request.resource.data), so users can't, say, set role: 'admin' on their own profile.

5. Never ship admin credentials

Service-account JSON and firebase-admin belong only in Cloud Functions or another server. In the browser they bypass all rules.

6. Consider App Check

App Check helps ensure requests come from your genuine app, reducing abuse of your backend. It complements rules; it doesn't replace them.

7. Test rules before deploying

Use the Rules Playground in the console or the Firebase Local Emulator Suite to try reads and writes as an unauthenticated user and as a different user.