saranskumar Goal
Review Firebase security rules for clarity, least privilege, and fit with document structure.
When to Use
- Firestore or Firebase client access is protected by rules.
- A Firebase feature handles user-owned or role-sensitive data.
- Existing rules are broad, confusing, or under-tested.
Instructions
- Identify collections, actors, and intended actions.
- Map rules to actual document ownership and auth claims.
- Check for broad read/write exposure and expensive rule assumptions.
- Recommend safer or clearer rule structure.
Constraints
- Do not assume client code is trusted.
- Keep rules aligned with actual document structure.
- Avoid rules that depend on data the client can fake.
Output Format
- rule review summary
- findings
- improved rule strategy
- edge cases to test
Examples
- "Review these Firestore rules for tenant isolation."
- "How should Firebase rules protect admin-only writes?"