Firebase test mode rules: how to tell if your database is open

What test mode looks like

Open Firebase console → Firestore → Rules. If you see something like this, your database is open to the internet:

allow read, write: if true;
// or
allow read, write: if request.time < timestamp.date(2026, 11, 1);

Safer rules

Require a signed-in user and limit each document to its owner:

rules_version = '2';
service cloud.firestore {
  match /databases/{db}/documents {
    match /users/{uid}/{doc=**} {
      allow read, write: if request.auth != null && request.auth.uid == uid;
    }
  }
}

Realtime Database

The Realtime Database has its own rules under Realtime Database → Rules. ".read": true or ".write": true at the top level means the whole database is public. You can test it yourself by opening https://YOUR-PROJECT.firebaseio.com/.json in a browser: if you see data, so can everyone.

Check it automatically

SafeCheck reads your Firebase config from your site, repo or Android app and tests whether the database answers without logging in.