Are Firebase Security Rules secure by default?

Firebase Security Rules are not secure by default in most configurations. When creating a new Firestore or Realtime Database, Firebase offers test mode which allows unrestricted read and write access for 30 days. Many developers forget to update these rules before going to production, leaving their database fully exposed. Production mode starts locked down but requires developers to write proper rules for their data model. UNPWNED checks your Firebase project for overly permissive security rules and flags databases that allow unauthenticated access.