[dazh]

What would be the correct way to set up security to prevent this?

[xyzeva]

Setting up firebase security rules: https://firebase.google.com/docs/rules/