What are Firebase security rules?
Firebase security rules are the rules that decide who can read and write the data in your Firebase database and file storage. Your Firebase settings are public by design, so the rules are the only thing standing between the internet and your data. If the rules say 'allow everyone', everyone gets in.
ON THIS PAGE
What it means
Your app talks to Firebase straight from the browser, so the connection details are visible to anyone. What protects the data is a short rulebook you write, which Firebase checks on every request.
Each rule says which paths it covers and who may read or write them. 'Only the signed-in owner of this document' is a typical rule.
Why it matters for vibe-coded apps
When you start a Firebase project it offers a 'test mode' that opens everything for a limited time, and AI tools often leave it as it is.
- Anyone who finds your project settings can read all of your data.
- Anyone can write, so they can change or delete your records.
- Test mode rules expire, which can also suddenly break your live app.
Example
Firestore rules for a users collection.
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if true;
}
}
}rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /users/{userId} {
allow read, write: if request.auth != null && request.auth.uid == userId;
}
}
}Anything not matched by a rule is refused, which is the safe default.
How to check if your app has this problem
- 1Open the Firebase console, go to Firestore Database (or Realtime Database, or Storage) and open the Rules tab.
- 2Look for allow read, write: if true, or rules that only check a date.
- 3Use the Rules Playground to test a request from a signed-out user. It should be refused.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Replace open rules with rules that check request.auth.uid against the owner of the data.
- 2Do the same for Storage and the Realtime Database if you use them.
- 3Test with two different users to confirm neither can see the other's data.
- 4Publish the rules and run a check again.
Review my Firebase security rules for Firestore and Storage. Replace any rule that allows open access (if true, or only a date check) with rules that require a signed-in user and only let them read and write documents they own, using request.auth.uid. Show me the final rules file and explain what each rule does. Don't change anything else.
Check if your app has this problem
Paste your website and we'll check for firebase security rules issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Row level securityA database setting that decides which rows each user can see or change.
- Authentication vs authorizationChecking who someone is, versus checking what they're allowed to do.
- Public storage bucketA folder of uploaded files that anyone with the link can open.
- API key exposureA secret key for a paid service ends up where the public can see it.
Related reading
Need help?
Not sure what this means for your app? Our team will explain it in plain English.