[groundCode]

Given that the use case for Firebase is taking the place of your traditional server side architecture and storage, it seems kind of obvious that you would have to take heed of the security implications and set them up properly. The security concerns don't magically vanish just because you don't write the server side code.

[manojlds]

Actually, people might be of the wrong notion that doing things like

    if(!user) { alert('you are not logged in!');} 

are enough even when coding on the client side.