mediumLogins, sessions and access

Any Signed-In User Can Access Everything

Anyone who creates an account can read or change every document under this rule.

Why it matters

`request.auth != null` only checks that the caller has an account. Since anyone can sign up, an attacker signs up and then reads or edits every other user's data. This is fine for genuinely shared data and wrong for anything private, which is most collections.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Any authenticated user
match /orders/{orderId} {
  allow read, write: if request.auth != null;
}

The smallest fix

minimal patch
match /orders/{orderId} {
  allow read, update, delete: if request.auth != null
    && resource.data.ownerId == request.auth.uid;
  allow create: if request.auth != null
    && request.resource.data.ownerId == request.auth.uid;
}

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] a rule allows any signed-in user: [the flagged code]. Change it to compare the document's owner field (or the user id in the path) to request.auth.uid. Keep `request.auth != null` only for collections that are meant to be shared among all users, and tell me which those are.

How to check the fix worked

1. Rules Playground: user A reads user B's document. Must be denied.
2. User A reads their own document. Allowed.

Further reading