The summary.
RULES ARE THE ONLY THING BETWEEN A USER AND ALL YOUR DATA
Clients talk to the database directly. Test mode permits everything, and the change is never made — deny by default, enforce ownership, and never let a client set its own role or balance.
Rules are not filters: a query that could return unreadable documents is rejected entirely.
MODEL FOR YOUR QUERIES, NOT FOR NORMALISATION
There are no joins, and you are billed per document read. Duplicate data so a screen renders from few reads, and maintain the duplicates server-side.
CLIENTS GENERATE COST DIRECTLY
A defect in the application multiplies across every installation. A listener not detached consumes reads continuously.
Set budget alerts immediately — most services do not stop at a limit.
FUNCTIONS TRIGGERED BY WRITES THAT THEMSELVES WRITE CREATE BILLING LOOPS
Check whether the change requires action before acting, and make every operation safe to run twice.
PHONE AUTHENTICATION COSTS MONEY PER VERIFICATION AND IS TARGETED FOR ABUSE
Enable abuse protection and monitor volume.
FIREBASE AND GOOGLE CLOUD ARE NOT ALTERNATIVES
One project can use both, and most substantial applications eventually do.
