Firestore rules that allow read, write: if true let anyone read, change or delete your whole database

Symptom

firestore.rules matches /{document=**} with allow read, write: if true;Documents can be read or overwritten by clients that never signed in

Cause

Security rules decide what clients may do in Firestore. If you are not authenticating users and configuring rules, anyone who guesses your project ID can steal, modify or delete the data. Firebase marks the allow-everything rule set as never to be used in production, since it lets anyone overwrite the entire database.

Fix

Require Firebase Authentication and write rules per collection that fit your data, for example letting only a document's owner read, change or delete it, and stopping updates that change the owner. Deploy the rules before launch.

ApplyCopy

rules_version = '2'; service cloud.firestore { match /databases/{database}/documents { match /posts/{postId} { allow read, delete: if request.auth != null && request.auth.uid == resource.data.author_uid; allow create: if request.auth != null && request.auth.uid == request.resource.data.author_uid; allow update: if request.auth != null && request.auth.uid == resource.data.author_uid && request.auth.uid == request.resource.data.author_uid; } } }

Affected

Cloud Firestore databases whose security rules grant open read or write access

Sources

• https://firebase.google.com/docs/firestore/security/insecure-rules

Last verified 2026-10-27 · Confirmed by 0 builders