Firebase rules "allow read, write: if true": how to fix it

Updated 2026-10-14 · Defensive guide for your own app

Short answer

allow read, write: if true; lets anyone on the internet read, change or delete your data. Firebase's own docs say never to use it in production. Replace it with rules that require sign-in and check ownership, test them in the Rules Playground or Emulator, then deploy. Note that request.auth != null alone is also flagged by Firebase as too broad: it lets every signed-in user touch everything.

Secure Firestore rules (owner only)

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /notes/{noteId} {
      allow read, delete: if request.auth != null
        && request.auth.uid == resource.data.author_uid;
      allow create: if request.auth != null
        && request.auth.uid == request.resource.data.author_uid;
      allow update: if request.auth != null
        && request.auth.uid == resource.data.author_uid
        && request.auth.uid == request.resource.data.author_uid;
    }
    // Everything else stays closed by default.
  }
}

Realtime Database and Storage

{
  "rules": {
    "users": {
      "$uid": {
        ".read": "auth != null && auth.uid === $uid",
        ".write": "auth != null && auth.uid === $uid"
      }
    }
  }
}

service firebase.storage {
  match /b/{bucket}/o {
    match /user/{userId}/{fileName} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
  }
}

Realtime Database rules cascade: a permissive parent rule can't be narrowed by a child rule, so put broad allows only where you mean them.

How to check

Search your repo for if true, ".read": true, ".write": true and allow read, write;.
In the Firebase console, open the Rules tab and use the Rules Playground to simulate an unauthenticated read and another user's write. Both should be denied.
Run automated tests against the Local Emulator Suite before each deploy.
Remember the CLI overwrites console rules on deploy; keep rules in version control.

Check your own project in seconds

Upload a .zip of your own Lovable, Bolt, Cursor, Supabase or Firebase project. ProdCanary reviews the code statically and shows your top 3 risks with plain-English fixes. Your upload is deleted right after the scan.

Run a free scan

FAQ

Is test mode OK if my app isn't launched?

Only while nothing is deployed publicly. Once the app is live, Firebase notes anyone who guesses your project ID can reach the data.

Do rules apply to my server code?

No. Firebase says the server client libraries bypass Security Rules and use IAM instead, so secure those credentials separately.

How long do rule changes take?

Firebase says up to a minute for new queries and up to 10 minutes for active listeners.

Sources

This guide is for securing apps you own or are authorised to work on. Facts above are from the official docs linked; check them for changes.