How do I secure Firestore properly?

Firestore security requires writing granular Security Rules that validate authentication, authorization, and data structure for every collection and document. Rules should check request.auth to verify the user is authenticated and validate that they only access their own data using resource.data fields. You should also validate data types and required fields in write rules using request.resource.data. Avoid using wildcards like match /{document=**} with broad allow rules, as this exposes your entire database. UNPWNED scans your Firestore configuration and identifies rules that are overly permissive or missing authentication checks.