Reviews Firebase Security Rules before they ship: Cloud Firestore, Realtime Database, and Cloud Storage for Firebase. Paste the rules, the data model, and the client code that reads and writes the data to find test mode and open rules, signed-in checks used as the only authorization while anyone can sign up, owner fields a client can set to another user, roles, plans, and credits a client can write into its own document, list and collection group queries that expose every user's records, parent grants that cascade over stricter children, and upload paths with no owner, size, or content type rule. Returns a verdict, an access map, evidence-linked findings, the smallest fix in the rules language, and emulator tests that prove it.