https://shipreadyai.dev/learn/findings/o15-firestore-open

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Firestore collections answer without a sign in

Requests with no sign in came back with documents from these collections: {collections}. ShipReady records the collection names and the counts and never keeps a document.

## Why AI-built apps get this

Firebase ships with open rules while you build, and the console says so. Turning them into real rules is a separate task with no deadline attached, and the app behaves identically either way.

## Evidence line

GET https://example-app.firebaseio.com/.json returned 200 with data

## The fix

Rewrite the Firestore rules so every read requires an authenticated caller scoped to the owner of the document.

## Prompt

Rewrite the Firestore rules so no collection is readable without an authenticated caller scoped to the owner.