Any signed-in Firebase user can read the whole database

Symptom

Signed-out visitors are blocked. Any account, including one you just created, can read and write every document.

Root cause

Firebase documents a second insecure pattern: rules that only check request.auth.uid != null, or auth.uid !== null, and then allow read and write on the whole database. The guide says if a rule includes auth != null, confirm you actually want every logged-in user to have that access. The fix it shows is to narrow the condition with an owner id or a role, not to stop at "someone is signed in."

In this project's Firebase rules, find allow read, write: if request.auth != null and Realtime Database rules that only check auth.uid !== null.

Replace them so the path or document owner must match request.auth.uid. Do not treat a role field on a document the user can edit as proof of admin. Put admin claims in custom claims or in a document the user cannot write. Deploy to your own project and simulate user B reading user A's document. It must be denied.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. Open the rules for your own Firebase project and search for auth != null and auth.uid !== null.
2. If that is the only condition on a collection of private documents, the rule is too wide.
3. In the Rules Simulator, as a second test user in your project, request another user's document. It should be denied.

Sources

• Firebase: Avoid insecure rules