Firebase security rules for apps built with AI

Updated

Are my Firebase security rules safe?

Your rules are unsafe if they contain allow read, write: if true, a test mode date check like request.time < timestamp.date(...), or a check that only asks request.auth != null for data that belongs to one user. The Firebase apiKey in your web config is public by design; the rules are the only thing protecting your data.

The three patterns that leak

  • allow read, write: if true; anyone with your project id can read and change everything
  • allow read, write: if request.time < timestamp.date(2026, 11, 1); the "test mode" rule, open to everyone until that date, then closed to everyone
  • allow read, write: if request.auth != null; any logged-in user, and signing up is free, can read every other user's documents

Owner-only rules to start from

Store the owner's uid on each document, then compare it to the caller. Creating a document must also check that the new owner is the caller.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /notes/{noteId} {
      allow read, update, delete: if request.auth != null
        && resource.data.ownerId == request.auth.uid;
      allow create: if request.auth != null
        && request.resource.data.ownerId == request.auth.uid;
    }
  }
}

Fields users must not change

If a user document holds role, plan or credits, an owner rule still lets the user change those fields. Block them on update:

allow update: if request.auth.uid == userId
  && !request.resource.data.diff(resource.data).affectedKeys()
       .hasAny(['role', 'plan', 'credits']);

Storage and Realtime Database

Cloud Storage has its own rules file and the same test mode trap: check it separately. In the Realtime Database, ".read": true or ".write": true at the top of the rules opens the whole database.

Questions

Is it safe that my Firebase apiKey is in my JavaScript?

Yes. It identifies your project; it does not grant access. Rules decide access. You can add App Check to make scripted abuse harder, but it does not replace rules.

How do I test my rules?

Use the Rules Playground in the Firebase console or the emulator, and run the two-account test: log in as user B and try to read user A's document.