I still see devs (even pros) leaving this in their Firestore rules during testing:
// ❌ PLEASE DON'T
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if true;
}
}
}
It works. It’s fast.
It also means anyone on the internet can read, write, delete, or overwrite anything in your database — no auth needed.
✅ Better: Restrict by request.auth != null and, if possible, user-specific ownership.
service cloud.firestore {
match /databases/{database}/documents {
match /users/{userId} {
allow read, write: if request.auth != null && request.auth.uid == userId;
}
}
}
This way:
Only logged-in users can access data
They can only touch their own documents
🧠 Takeaway:
> “Your Firebase rules are your database’s last line of defense — treat them like production code.”
If this saved your data from getting roasted, maybe buy me a coffee to keep the security tips flowing:
#firebase #firestore #securitytips #dailydev #buymeacoffee