Ctrl+Z Therapy
CasesQuick answersGuides10-minute checklistHow we testCartoonSend it in

Is your Firebase database open to anyone? Check your Firestore rules

Ship ItChecked against the official source

Source checked 9 Oct 2026 · Published 23 Oct 2026 · Last reviewed 23 Oct 2026 · By Ctrl+Z Therapy (how we test)

The short answer

If you started your Cloud Firestore database in test mode, Firebase's own docs say it allows anyone to read and overwrite your data. Google warns never to use an open ruleset in production: if you're not authenticating users and configuring security rules, anyone who guesses your project ID can steal, modify, or delete the data. The fix is real Security Rules.

What to do

  1. Open your Security Rules in the Firebase console and look for open test rules.
  2. At minimum, require sign-in (request.auth != null), and let users read and write only their own documents (request.auth.uid == userId).
  3. Publish the new rules.
  4. Ask your AI tool: "Review my Firebase Security Rules. Replace open test rules with rules that require sign-in and let users read and write only their own documents."

Good to know

  • Production mode is the opposite: it denies all reads and writes from mobile and web clients until you write rules.

Source

Checked on 9 Oct 2026. Prices, limits and settings change, so check the source before you rely on them.

Related