https://shipreadyai.dev/learn/findings/o15-firebase-database-open

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# The Firebase database answers without a sign in

A plain request to {endpoint} returned data with no sign in, so the rules on that database let anonymous readers in.

## Why AI-built apps get this

Firebase ships with open rules while you build, and the console says so. Turning them into real rules is a separate task with no deadline attached, and the app behaves identically either way.

## Evidence line

GET https://example-app.firebaseio.com/.json returned 200 with data

## The fix

Replace the open rules with rules that require an authenticated caller and scope each path to its owner.

## Prompt

Rewrite the Firebase database rules so no path is readable or writable without an authenticated caller scoped to the owner.