Fixes · Security holes

Firebase rules let anyone write (or test mode is about to expire)

Firestore in test mode, or rules with allow write: if true, let anyone change or delete your data, and test mode switches everything off on its expiry date.

What you see

firestore.rules has allow read, write: if true, or the test-mode rule that opens everything until a date.

Why it happens

Test mode is how Firebase starts a project. It's meant to be replaced before launch, and nothing reminds you.

How to fix it

  1. Require a signed-in user, matched to the document: allow write: if request.auth != null && request.auth.uid == userId.
  2. Deploy the rules: firebase deploy --only firestore:rules.

Or ask your AI tool to fix it

Paste this into Lovable, Bolt, v0, Replit or Cursor, and let it make the change.

Replace the open Firestore security rules with rules that require a signed-in user and only let each user read and write their own documents. Keep public reads only where data is meant to be public.

Don't change what the app does.
Never put a secret key or password in the code: read it from an environment variable.
If a step has to be done outside the code, like revoking a key in a provider's dashboard, list it for me at the end instead of skipping it.

How Launchpad helps

The launch check reads the rules files and flags open and test-mode rules.

Check your app for this, freeJoin the waitlist

Related