The critical configuration.
WHAT THE MOST COMMON SERIOUS MISTAKE IS
Security rules left open.
WHAT THAT MEANS
Anyone can read or write the entire database.
WHY IT HAPPENS
Development mode permits everything, and the change is never made.
WHAT TO DO
Write rules before any real data exists, and deny by default.
WHAT RULES SHOULD ENFORCE
That a user may only read and write their own data That required fields exist and have valid types That values cannot be set to anything the user should not control
WHY THAT LAST POINT
Without it, a client can set its own role or balance.
WHAT TO NEVER TRUST
Anything the client sends.
WHAT TO ENFORCE SERVER-SIDE
Anything affecting money, permissions or other users.
WHAT TO USE FOR THAT
Server-side functions, where rules are insufficient.
WHAT TO KNOW ABOUT CONFIGURATION VALUES
The client configuration is not a secret, and being public is expected.
WHAT PROTECTS YOU
The rules, not the configuration.
WHAT TO TEST
The rules, with the emulator and automated tests.
WHAT TO REVIEW
Rules, after every data model change.
