Is my data already exposed?

An alert about the rules doesn’t tell you whether anyone has used the access. Fix the rules first, then look through your data and user accounts for anything you don’t recognize.

Can I just set the rules to allow nothing?

Only if your app reads and writes through a server. Rules that deny everything block every client, while the Firebase Admin SDK and Cloud Functions still get through. If your app talks to Firestore from the browser or the phone, it stops working.

Does the same apply to Realtime Database and Cloud Storage?

Yes. Each has its own rules, and Firebase’s guide to avoiding insecure rules covers all three. The free checker reads Cloud Firestore and Cloud Storage rules; Realtime Database rules use a different JSON format. The Rules Audit covers Firestore and Storage rules; Realtime Database rules are a separate job, so email first.

Can you fix it for me?

Yes. The Firebase Security Rules Audit tests whether one user can read or edit another customer’s data and fixes what it finds in a pull request; production is never touched. If one rule or screen is the whole problem, the App Fix Ticket covers it.

Firebase Insecure Rules Alert: How to Fix It

Short answer

Your rules let people read or write data they shouldn’t, commonly test-mode rules left on after launch, or rules that only check that someone is signed in. Replace them with rules that check who owns each document, test them in the Rules Playground or the emulator, then deploy. Paste your rules into the free checker first to see which patterns you have.

Why Firebase flagged it, and the fix

01
Open rules left on from development
“anyone who guesses your project ID can steal, modify, or delete the data.” Firebase docs, Fix insecure rules
Rules that allow every read and write are fine on your laptop, but your project ID ships inside every copy of your app. Replace them with rules that let each signed-in user reach only their own documents, and keep anything nobody should touch closed.
```
// before: allow read, write: if true;
match /projects/{projectId} {
  allow read, delete: if request.auth.uid == resource.data.ownerId;
  allow create: if request.auth.uid == request.resource.data.ownerId;
  allow update: if request.auth.uid == resource.data.ownerId
    && request.resource.data.ownerId == resource.data.ownerId;
}
```
02
Rules that only check sign-in
“If one of your rules includes auth != null, confirm that you want any logged-in user to have access to the data.” Firebase docs, Fix insecure rules
If anyone can sign up for your app, being signed in isn’t a permission. Compare request.auth.uid with an owner field on the document, or look up the user’s role or team before allowing the read or write.
03
Email domain checks without verification
“emails are not always verified during sign-in until an additional step is performed by the user upon receipt of a verification email.” Firebase docs, Fix insecure rules
A rule that lets in anyone whose email ends in your company’s domain also lets in someone who signs up with that address and never confirms it. Check that the email is verified as well.
```
allow read: if request.auth != null
  && request.auth.token.email_verified
  && request.auth.token.email.matches('.*@example[.]com');
```
04
Test the new rules before you deploy
Try your app’s real requests in the Rules Playground on the Rules tab of the Firebase console, signed in as different users, or run unit tests against the Firestore emulator. Tighter rules can break screens that relied on the open ones, and the error you’d then see is “Missing or insufficient permissions”.

Checked against the vendor’s docs on October 31, 2026: Firebase docs: Fix insecure rules (Cloud Firestore); Firebase docs: Avoid insecure rules; Firebase docs: Quickly validate Firebase Security Rules.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Firebase security alertFirebase says your Cloud Firestore database isn’t properly secured

Why Firebase flagged it, and the fix

Open rules left on from development

Rules that only check sign-in

Email domain checks without verification

Test the new rules before you deploy

Rather hand it over?

More on this error

Describe it and get a written quote