Fix: Firebase rules allow read, write: if true (public rules)

When you create a database, Firebase lets you start in test mode, which Firebase describes as allowing anyone to read and overwrite your data. Rules such as allow read, write: if true (Firestore) or ".read": true, ".write": true (Realtime Database) are that open state. Firebase's guidance is that anyone who guesses your project ID can steal, modify or delete the data. The fix is to write rules based on authentication and ownership before real users arrive.

• Test mode was chosen during setup so the first screens would work, and the rules were never revisited.
• An AI tool met a permissions error and resolved it by opening the rules.
• The rules include a date condition (request.time compared with a timestamp) and someone pushed the date forward when access stopped, instead of writing real rules.
• The team assumed the Firebase config in the app was secret. It is not. The config identifies your project and is meant to be public, so rules are the only protection for client access.

1. 1List your collections and decide, for each, who may read and who may write.
2. 2Make sure users sign in with Firebase Authentication, so request.auth is available to rules.
3. 3Write rules per collection. Start from deny, then allow the specific access you listed.
4. 4Check that content meant to be public is read-only for the public, with writes limited to its owner or to your server.
5. 5Repeat for Realtime Database and Cloud Storage if you use them. Each has its own rules.
6. 6Publish the rules, then click through every main flow of your app to find anything the new rules block.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId}/{document=**} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }

    match /posts/{postId} {
      allow read: if true;
      allow create: if request.auth != null
        && request.resource.data.authorId == request.auth.uid;
      allow update, delete: if request.auth != null
        && resource.data.authorId == request.auth.uid;
    }
  }
}

Use the Rules Playground in the Firebase console to simulate a read and a write with authentication switched off. Both should be denied. You can also call the Firestore REST API for your own project with no credentials. Before the fix it returns documents. After the fix it should return a 403 with PERMISSION_DENIED.

curl 'https://firestore.googleapis.com/v1/projects/YOUR_PROJECT_ID/databases/(default)/documents/users?pageSize=1'